What is password spraying?
Password spraying inverts the usual attack: instead of guessing many passwords for one account, it tries one common password against thousands of accounts. Each account sees only a single failed attempt, so ordinary lockout rules may not trigger. In a large population, one of those guesses may work.
- Topic
- Attacks
- Reading time
- 1 min
- Reviewed
On this page
Why lockouts do not catch it
Account lockout triggers on repeated failures against one account. Spraying makes one attempt per account, so no threshold is ever crossed. Detection has to happen at the network level, by noticing many single failures from one source, which many systems do not do.
The defence is population-wide
Individually, avoid common passwords because spraying only works when your password is on the attacker's short list. Organisations should screen new passwords against known-breached lists when they are set.
Sources
These primary references support the terminology and current security guidance used in this definition.
