# What is Password spraying?

> Trying one common password against many accounts, rather than many passwords against one account.

Last reviewed: 2026-09-01

## Password spraying

Category: Attacks

Canonical page: https://moolkey.com/glossary/password-spraying

Password spraying inverts the usual attack: instead of guessing many passwords for one account, it tries one common password against thousands of accounts. Each account sees only a single failed attempt, so ordinary lockout rules may not trigger. In a large population, one of those guesses may work.

### Why lockouts do not catch it

Account lockout triggers on repeated failures against one account. Spraying makes one attempt per account, so no threshold is ever crossed. Detection has to happen at the network level, by noticing many single failures from one source, which many systems do not do.

### The defence is population-wide

Individually, avoid common passwords because spraying only works when your password is on the attacker's short list. Organisations should screen new passwords against known-breached lists when they are set.

Further reading: [Check whether your password is on those lists](https://moolkey.com/tools/password-breach-check)

### Sources

- [OWASP: Credential Stuffing Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html): How password reuse is replayed at scale and how services can limit the damage.
- [NIST: SP 800-63B-4: Authentication and authenticator management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final): Current requirements for passwords, authenticators, recovery, and rate limits.
- [CISA: Secure Our World](https://www.cisa.gov/secure-our-world): Public guidance for recognizing phishing and protecting high-value accounts.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.