Most people picture a hacker hammering one account with thousands of guesses. Password spraying flips that idea on its head — and slips past the very defenses built to stop the brute-force approach. Understanding it shows exactly why a common password is dangerous even with security in place. Our GetMyPassword team explains what a password spraying attack is and how to stay safe.
What password spraying is
Password spraying is an attack that tries a few very common passwords across many different accounts. Instead of guessing thousands of passwords on one login — which quickly locks the account — the attacker takes one popular password and “sprays” it against a long list of usernames, then moves to the next password. With enough accounts, someone, somewhere, is always using that weak choice.
Why it slips past defenses
The clever part is the timing. Account-lockout rules trigger after a handful of failed attempts on a single account. By trying just one or two passwords per account before moving on, spraying stays under that limit and avoids tripping alarms. It does not need to crack your password — it only needs to find the people who picked something predictable like “Password1” or a season and year.
How it differs from similar attacks
- Brute force: many password guesses against one account — noisy and easily locked out.
- Password spraying: a few common passwords against many accounts — quiet and lockout-proof.
- Credential stuffing: real stolen username-password pairs from a breach, reused on other sites.
- The common thread: all of them fail against a strong, unique password and two-factor authentication.
Password spraying does not break strong passwords — it harvests weak, predictable ones across a crowd. The defense is simply not to be the person using “Password1.”
How to protect yourself
Spraying preys on predictability, so beat it by being unpredictable. Never use a common or pattern-based password, and give every account its own long, random one from our password generator. Turn on two-factor authentication so that even a sprayed-and-guessed password cannot open the account on its own. A unique, random password is simply never on the attacker’s short list.
Frequently asked questions
What is a password spraying attack?
It is an attack that tries a few very common passwords across many accounts, rather than many passwords on one account. By using just one or two guesses per account, it avoids lockouts and succeeds against anyone using a weak, predictable password.
How is password spraying different from brute force?
Brute force throws many password guesses at a single account and quickly triggers lockouts. Password spraying tries a few common passwords across many accounts, staying under lockout limits and flying under the radar.
How do I protect against password spraying?
Never use common or pattern-based passwords, use a long, random, unique password for every account, and turn on two-factor authentication. A unique, random password is never on the attacker’s short list of common guesses.