Cybersecurity glossary
What is Password Spraying?
Learn what password spraying is, how attackers try a few common passwords across many accounts to avoid lockouts, how it differs from stuffing and brute force, and which defenses work.
Definition
Password spraying is a credential attack in which adversaries attempt a small number of commonly used passwords against many usernames, staying under per-account lockout thresholds while discovering accounts that reuse weak passwords.
Why password spraying matters
Organizations often defend the wrong failure mode. They lock an account after five bad passwords—then attackers try one password against five thousand accounts. Password spraying is that low-and-slow strategy, and it routinely finds seasonal passwords, keyboard patterns, and company-name variants.
Sprays target cloud identity, VPN, email, and remote desktop portals where usernames are guessable and MFA is incomplete.
How password spraying works
Build a username list
Harvest emails from OSINT, breaches, or predictable naming schemes.
Pick common passwords
Choose a few high-probability passwords, often themed by season or company.
Attempt one password widely
Try that password across many accounts under lockout thresholds.
Rotate slowly
Wait and try the next password across the list to stay quiet.
Confirm successes
Validate mailbox or VPN access on hits; enroll persistence if MFA is absent.
Expand access
Move from the sprayed account into SSO apps, mail forwarding, or admin paths.
Spraying vs stuffing vs brute force
| Attack | Pattern |
|---|---|
| Password spraying | Few passwords × many users |
| Credential stuffing | Known breached pairs × target logins |
| Brute force | Many passwords × one user/secret |
Defenses that work
MFA everywhere practical
Especially on email, VPN, and admin portals—the usual spray jackpots.
Banned password lists
Block common and org-specific passwords at set and reset time.
Directory-wide detection
Alert on many accounts failing with shared passwords or timing patterns.
Legacy protocol lockdown
Disable auth paths that bypass modern MFA controls.
- Enforce MFA for remote access and email; prefer phishing-resistant methods for admins.
- Detect sprays with tenant-level analytics, not only per-account counters.
- Ban common passwords and leaked-password corpora where policy allows.
- Slow or challenge unusual authentication patterns with risk-based controls.
- Reduce username enumeration via consistent error responses where feasible.
- Monitor successful logins after widespread failures.
- Disable legacy IMAP/POP/SMTP AUTH or basic auth if MFA cannot cover them.
- Educate users against seasonal password patterns still used in enterprises.
The practical takeaway
Password spraying finds weak passwords by trying a few guesses across many accounts, specifically to evade per-user lockouts. It is one of the most common enterprise identity attacks.
Stop it with MFA, banned passwords, and detection that watches the whole directory—not just one noisy account.
Related security terms
Brute-Force Attack
High-volume guessing often focused on one account or secret space.
Credential Stuffing
Replays breached username/password pairs rather than common password lists.
Multi-Factor Authentication (MFA)
Blocks many spray successes even when a weak password matches.
Broken Authentication
Broader authentication weaknesses that spraying exploits.
Brute Force
Vulnerability-focused guidance related to guessing attacks.
Frequently asked questions
What is password spraying in simple terms?
Password spraying tries a few popular passwords—like Winter2026!—against lots of usernames. It avoids locking one account by not trying thousands of guesses on the same user.
How is spraying different from brute force?
Classic online brute force hammers one account with many passwords. Spraying flips that: few passwords, many accounts, low attempts per user.
How is spraying different from credential stuffing?
Stuffing uses known leaked pairs. Spraying uses common passwords guessed against organizational username lists.
Why do enterprises see password sprays so often?
Predictable usernames (first.last), seasonal password patterns, and legacy protocols without MFA create a large, enumerable target set.
Does account lockout stop spraying?
Simple per-account lockouts are what spraying is designed to evade. Detect across the directory and use smarter thresholds, MFA, and banned-password lists.
What are signs of a spray?
Many accounts failing once or twice with the same password, distributed sources, and sudden successes on previously quiet accounts.
How do you prevent password spraying?
Enforce MFA, ban common passwords, detect tenant-wide failure patterns, disable legacy auth where possible, and use risk-based lockouts or tar-pits.
References
Explore authoritative guidance and frameworks related to password spraying.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.