Imagine a thief who cannot read your password but copies the sealed envelope that proves you logged in — then mails that same envelope again to walk in as you. That is the idea behind a replay attack: capture something valid and send it a second time. Our GetMyPassword team explains what a replay attack is, where it happens, and how it is stopped.
What a replay attack is
A replay attack is when an attacker captures a valid piece of data — a login token, a request, an authentication message — and resends it later to impersonate you or repeat an action. The attacker does not need to crack or even understand the data. They simply record a genuine, already-approved message and “replay” it, hoping the system accepts it again as if it were fresh.
How it works in practice
Picture an app that logs you in and gets back a token proving “this is an authenticated session.” If that token travels unprotected, someone snooping the network — say on open Wi-Fi — can copy it and present it themselves. The same trick applies to a captured “transfer money” request or a recorded access signal for a car or door. Because the message was legitimate when first sent, a naive system cannot tell the replay from the real thing.
How systems stop it
- One-time values (nonces) — each request carries a unique number that is only ever accepted once.
- Timestamps and short expiry — a captured message is rejected once its small time window passes.
- Encryption like HTTPS — protecting data in transit makes it far harder to capture in the first place.
- Session binding — tying a token to a device or context so a copy used elsewhere fails.
A replay attack succeeds only when “valid once” is treated as “valid forever.” The defenses all do the same thing: make each message usable a single time, then never again.
What it means for you
Most replay defenses live inside the apps and protocols you use, not in your hands — but your habits still matter. Favor sites and apps that use HTTPS, avoid logging into sensitive accounts on untrusted open Wi-Fi, and keep your software updated so old, replayable protocols are retired. And since a captured login is far less useful when there is a second barrier, protect every account with a unique password from our password generator and two-factor authentication.
Frequently asked questions
What is a replay attack?
It is when an attacker captures a valid message — like a login token or a request — and resends it later to impersonate you or repeat an action, without needing to crack or understand the data itself.
How do systems prevent replay attacks?
They use one-time values (nonces) that are accepted only once, timestamps with short expiry windows, encryption such as HTTPS to prevent capture, and session binding so a copied token fails when used elsewhere.
Can a strong password stop a replay attack?
A password alone does not stop the replay itself, since the attacker reuses an already-valid message. But using HTTPS, avoiding untrusted Wi-Fi, and adding two-factor authentication greatly limit what a captured login can achieve.