Understand brute force, dictionary attacks, credential stuffing, password spraying, and offline cracking—and the controls that actually reduce risk.
Security is often limited by its weakest authentication path. Strong encryption and sophisticated detection tools cannot compensate for a reused password that an attacker already knows. Password attacks range from online guessing against a login form to high-speed offline cracking of hashes stolen in a breach. The defensive controls differ, so understanding the attack path matters.
Common password attack methods
Brute-force attacks
A brute-force attack systematically tests possible character combinations. Online attacks are constrained by network latency, rate limits, account lockouts, and bot detection. Offline attacks are more dangerous: after stealing password hashes, an attacker can make guesses on their own hardware without interacting with the affected service.
Password length, predictability, the hash algorithm, its work factor, and the attacker's hardware all affect the time required. Published cracking-time charts are only estimates under stated assumptions—not a guarantee for a specific system.
Source and methodology: Hive Systems password table
Dictionary and rule-based attacks
Attackers rarely start with random strings. They test common passwords, leaked passwords, words, names, dates, keyboard patterns, and predictable substitutions such as replacing “a” with “@”. Rule engines combine these patterns efficiently. A long but common phrase can therefore be weaker than a unique, randomly generated one.
Precomputed tables and offline cracking
Rainbow tables contain precomputed hash results. A unique random salt for every password makes a single precomputed table impractical across many accounts. Modern systems should also use a deliberately slow password-hashing function such as Argon2id, scrypt, bcrypt, or PBKDF2. A pepper can add defense in depth when it is stored separately from the password database, but it does not replace salts or a suitable work factor.
Credential stuffing
Credential stuffing uses username-and-password pairs exposed by another service. Automated tools try the same credentials against email, social media, banking, and workplace accounts. Password reuse turns an incident at one provider into account takeover elsewhere.
The strongest controls are unique passwords, screening new passwords against a blocklist of known compromised values, bot and anomaly detection, and multi-factor authentication. Phishing-resistant methods such as passkeys or hardware security keys provide better protection than codes that can be relayed by an attacker.
Password spraying
Password spraying reverses the usual brute-force pattern: an attacker tries one or a few common passwords across many accounts. This can avoid per-account lockout thresholds. Defenders should rate-limit across accounts and network signals, monitor distributed failures, block compromised passwords, and protect privileged accounts with phishing-resistant authentication.
Controls for individuals
Use a password manager to generate a different, long password for every account.
Prefer passkeys where they are available.
Enable multi-factor authentication, prioritizing security keys or passkeys for important accounts.
Check whether a password is known to breach datasets without sending the password itself. LeakData's password security check uses a privacy-preserving lookup.
Change a password promptly when compromise is suspected; routine calendar-based changes are not a substitute for monitoring.
Controls for organizations
Store passwords with a modern, salted, slow password-hashing function and review work factors over time.
Apply compromised-password blocklists at enrollment and password change.
Use layered rate limits, bot controls, risk signals, and alerting rather than relying on rigid lockouts alone.
Design secure recovery flows; attackers often target password reset and help-desk processes.
Never log plaintext passwords or place them in analytics, URLs, or support tickets.
Conclusion
Password attacks continue to evolve, but their core economics can be changed. Unique credentials stop reuse from propagating, slow password hashing raises offline attack cost, and phishing-resistant authentication can prevent a stolen password from being enough. Passwords will remain in many systems for some time; the practical goal is to reduce how much trust is placed in a password alone. Read more in Will Passwords Disappear?