Glossary
Password spraying is a brute-force variant in which an attacker tries a small number of common passwords across many different accounts (rather than many passwords against one account) specifically to avoid the lockouts that would be triggered by repeated failed attempts on a single account. It’s a stealthy, "low-and-slow" technique designed to fly under the radar of basic defenses.
The insight behind password spraying is that lockout policies protect individual accounts, not the system as a whole. By spreading attempts thinly across a large population, an attacker stays below each account’s failed-attempt threshold while still testing common passwords against thousands of users.
The attacker obtains a list of valid usernames (often easy to enumerate or gather) and picks a few very common or predictable passwords, seasonal patterns, "Password123," company-name variants. They then try the first password against every account, wait to avoid detection, try the next password against every account, and so on. Because any given account sees only one or two failed attempts, lockouts don’t trigger, and the attack can run for a long time. It only takes a small percentage of users choosing a weak, common password for the attack to succeed somewhere.
Password spraying exploits two realities: people reuse weak, predictable passwords, and defenses focused on per-account lockouts miss attacks spread across many accounts. Its low volume per account also evades naive rate limiting. Detecting it requires looking at patterns across the whole authentication system (many accounts failing with the same password, or a distributed pattern of single failed attempts) rather than at individual accounts in isolation.
Effective defenses include banning common and breached passwords (so the sprayed guesses don’t work), MFA (so a correct password isn’t sufficient), and detection that analyzes authentication patterns system-wide to spot spraying rather than per-account thresholds. Risk-based authentication helps by flagging the anomalous login patterns spraying produces. And, as ever, going passwordless removes the target entirely, there’s no common password to spray.
What is password spraying?
Trying a few common passwords across many accounts to avoid triggering per-account lockouts.
How is password spraying different from brute force?
Classic brute force tries many passwords against one account; spraying tries a few passwords across many accounts to stay stealthy.
How do you detect password spraying?
By analyzing authentication patterns system-wide (many accounts failing with the same password) not just per-account lockouts.
How do you prevent password spraying?
Ban common/breached passwords, require MFA, use risk-based detection, and go passwordless.
Related: Brute Force Attack · Credential Stuffing · Multi-Factor Authentication (MFA) · Risk-Based Authentication · Passwordless Authentication
