Password spraying
In plain terms
Instead of trying a thousand passwords on your account, the attacker tries one — a very common one — on a thousand accounts. No account gets locked, because none has taken more than one attempt.
Definition
Password spraying consists of testing a very small number of extremely common passwords against a very large number of accounts, staying below the attempt threshold that would trigger a lockout.
How it works
A service's protections count failures per account: three or five failed attempts, and access locks. The attacker inverts that loop. They start from a list of accounts — often professional addresses, whose format is predictable from the org chart — and test a single password across the whole list, then wait, then test a second one. The passwords chosen aren't random: they're the ones security policies mechanically produce, a season followed by the year, the company name followed by an exclamation mark, or the keyboard pattern everyone types when a quarterly change is required. It only takes one account to get in, and in an organization of several hundred people, there's almost always one.
Warning signs
- Successful logins from an unusual location or device on a rarely used account
- A wave of authentication failures spread across many accounts, visible on the admin side
- A service account or shared mailbox, without two-factor authentication, used at odd hours
- An internal policy requiring frequent changes, which pushes people toward patterned passwords
- Professional addresses built on a guessable format and published online
How to verify
On the user side, the account's login history is the only clue: a successful login you don't recognize. On the organization side, the signature is a low but very spread-out failure rate, invisible if you only monitor accounts one at a time. Service accounts and shared mailboxes should be checked first: they're the ones no one watches.
What to do
Don't build your password on a pattern — season, year, company name, keyboard sequence — even if it satisfies the displayed complexity rules. A long phrase unrelated to you holds up, where "Autumn2026!" appears in every attack list. Enable two-factor authentication, which makes a single successful guess insufficient.
If it already happened
Change the password of the account and every account that shared the same pattern, not just the same word. Revoke active sessions, check email forwarding rules and third-party app permissions. In an organization, the incident rarely concerns a single account: ask for a check across the whole domain rather than just your own.
Frequently asked questions
- My password met every complexity rule.
- Complexity rules check a shape, not originality. "Autumn2026!" contains a capital letter, digits, and a special character, and yet tops attack lists, precisely because these rules push everyone toward the same constructions.
- How is this different from a brute-force attack?
- Brute force tries many passwords on one account, which triggers the lockout. Spraying tries few passwords on many accounts, which triggers nothing. It's the same idea flipped around to bypass exactly the protection that exists.
Related attacks
Official sources
This article is part of the Credentials and accounts family. Last updated: 2026-09-02.