Attackers rarely guess passwords one random character at a time — that would take forever. Instead, many start with a list of words and common passwords and try those first, because people are predictable. That shortcut is a dictionary attack, and understanding it explains exactly why some passwords fall in seconds. Our GetMyPassword team breaks down what a dictionary attack is and how to beat it.
What a dictionary attack is
A dictionary attack tries passwords from a prepared list of words and common choices instead of every possible combination. The “dictionary” is not just the English language — it is a curated wordlist of real words, names, places, dates and the passwords that leak in breaches over and over. The attacker runs through it quickly, betting that your password is something a human would actually pick. Often, that bet pays off.
How it differs from brute force
A pure brute-force attack tries every combination of characters, which is thorough but painfully slow against a long password. A dictionary attack is the smarter, faster cousin: it skips the gibberish and goes straight for likely candidates. That is why password length and randomness matter so much — a dictionary has millions of human-chosen entries ready to test, but it does not contain a long string of random characters that no one ever wrote down.
Why it works so often
- People reuse classics — “password”, “qwerty”, “123456”, “iloveyou” top every list.
- Names and dates — a pet, a child, a birth year are all in the dictionary.
- Predictable tweaks — attacks add rules, so “P@ssw0rd1” is barely harder than “password”.
- Breach reuse — passwords leaked elsewhere get folded straight into the wordlist.
A dictionary attack does not break your password so much as recognize it. The cure is to use something no list could ever contain: long, random, and unique to one account.
How to beat a dictionary attack
The defense is simple: do not use anything a wordlist would hold. A long, random password from our password generator is not a word, a name, or a common pattern, so it is not in any dictionary. A passphrase of several random, unrelated words works too, by being long and unpredictable. Give every account its own such password, store them in a password manager, and turn on two-factor authentication — then even a clever wordlist has nothing to match.
Frequently asked questions
What is a dictionary attack?
It is a password-guessing attack that tries entries from a prepared list of words, names and common passwords instead of every possible combination. It is fast because it bets your password is something a human would actually choose.
How is a dictionary attack different from brute force?
Brute force tries every possible character combination, which is slow against long passwords. A dictionary attack skips the gibberish and tests likely human choices first, making it much faster when a password is a real word or common pattern.
How do I protect my password from a dictionary attack?
Use a long, random password or a passphrase of several random words, so it is not in any wordlist. Make it unique to each account, store it in a password manager, and turn on two-factor authentication.