Password spraying is trying a few common or seasonal passwords across a huge number of accounts, keeping attempts per account low so no single account trips its lockout. Its danger is that it hides inside normal failure rates and slips past defenses tuned to watch one account at a time.
What is password spraying, in plain English?
Password spraying flips brute force on its head. Instead of many passwords against one account, the attacker tries a few common passwords against a huge number of accounts. They pick passwords real people actually use, a seasonal favorite, a company name plus a year, a classic weak choice, and spray each one broadly across the user base, one or two attempts per account.
The point of keeping attempts per account low is stealth. Lockout rules typically count failures per account, so a single failed guess on each of thousands of accounts never trips any of them. The failures also blend into the normal background rate of people mistyping passwords, so nothing looks obviously wrong from a per-account view.
Spraying is the distributed, low-and-slow cousin of brute force. It succeeds because in any large population, some accounts always use one of those few weak passwords. Catching it requires looking across the whole user base at once, which is why it sits alongside credential stuffing, cracking, and bot attacks.
How password spraying runs
- Enumerate — Gather many usernames. The attacker builds a large list of valid or likely account names to spray against.
- Choose — Pick a few weak passwords. They select common or seasonal passwords that a slice of any large population is likely to use.
- Spray — One guess across everyone. Each password is tried once against each account, keeping per-account attempts under the lockout threshold.
- Harvest — Collect the weak ones. The accounts that used those passwords are compromised, all while staying under per-account alarms.
Spraying versus brute force and stuffing
Trait | Password spraying | Brute force / stuffing |
Spread | Few passwords across many accounts | Brute force: many passwords, one account |
Per-account attempts | Very low, to dodge lockouts | Brute force very high; stuffing one pair each |
Visibility | Hides in normal failure noise | Brute force loud; stuffing shows as a surge |
Best detection | Cross-account correlation by IP or ASN | Per-account rate limits or volume anomalies |
What it looks like in practice
In practice
Across a morning, thousands of accounts each register a single failed login. Per account, that is unremarkable, well within the normal rate of forgotten passwords, so no lockouts fire and no account-level alert triggers.
Correlating by source tells the real story: nearly all those failures trace to a small cluster of IPs, each trying the same seasonal password once against account after account. A handful of customers who used that exact password are quietly compromised. Only a view across the whole user base, grouping failures by IP and network, reveals the sweep.
Why it matters to operators
Password spraying is dangerous precisely because it is engineered to be invisible to per-account monitoring. Lockouts and rate limits that watch a single account never see it, and the failures hide in the ordinary noise of people mistyping. If your detection stops at the account level, spraying can run for a long time and quietly harvest every weak password in your base.
Seeing it requires a population-level view: correlate failed logins by IP, ASN, or network to reveal one source touching many accounts with the same password. Blunt the payoff with MFA and by banning breached or common passwords, so the few passwords a sprayer relies on simply do not exist in your user base. Per-account monitoring alone cannot see this pattern, and that is the core lesson.
What to watch for
- One failure, many accounts. A single failed attempt spread across a large number of accounts, each below the lockout line.
- Source concentration. Failures correlating to a small set of IPs or a single ASN despite touching many accounts.
- Common password signature. The same weak or seasonal password appearing across the failed attempts.
- Timing sweeps. Waves of low-volume failures moving through the user base in sequence.
- Weak-password hits. Successful logins on accounts using passwords that appear on common or breached lists.
Quick questions
How is password spraying different from brute force?
Brute force throws many passwords at one account and is loud. Spraying tries a few passwords across many accounts, keeping per-account attempts low to stay quiet and dodge lockouts.
Why does it evade lockouts?
Lockouts usually count failures per account. By making only one or two attempts on each account, spraying never reaches the threshold on any of them, so no lockout triggers.
How do you detect it?
By correlating failed logins across the whole user base, grouping by IP or ASN rather than per account. That reveals a single source touching many accounts with the same password.
Why is a population-level view essential?
The attack is invisible one account at a time. Only by looking across all accounts together does the pattern, many accounts, few passwords, shared source, become clear.
What stops spraying most effectively?
MFA plus banning common and breached passwords. If the few passwords a sprayer relies on cannot exist in your base, and a password alone is not enough, the attack yields little.
Is it related to credential stuffing?
Both are high-scale login attacks. Stuffing replays known breached pairs; spraying guesses a few common passwords broadly. Both need cross-account detection rather than per-account rules.
Go deeper
- FTC Consumer Advice: Scams ↗ — US consumer guidance on current scams and fraud, and how to report them.
- NIST Digital Identity Guidelines (SP 800-63) ↗ — The US standard for identity proofing and authentication assurance levels.