🔓 Password Spraying Attacks: What They Are and How to Stop Them (2026)
CISA's 2023 advisory AA23-347A ranked password spraying as the most commonly observed initial-access technique across US government networks — ahead of phishing. Attackers don't try every password against one account; they try one password against every account, and that inversion is exactly what defeats nearly every traditional lockout policy. A password spraying attack is a credential attack that tests one or a small number of commonly-used passwords across a large list of valid usernames, deliberately keeping attempts-per-account low enough to avoid triggering lockouts.
Spring2026! or Welcome1 — and tests them against thousands of valid account usernames. By attempting only a single password per account before moving on, the attacker stays below the lockout threshold that would alert defenders or block access.
Why password spraying is so effective
Standard account lockout policies are built to stop a different threat: an attacker hammering one account with hundreds of guesses. Spraying sidesteps this by turning the problem sideways. Instead of depth (many guesses per account), it uses breadth (one guess across many accounts). With 10,000 accounts in a corporate directory and a lockout threshold of five failed attempts, an attacker can test five passwords against every single account without locking out a single one.
The math is made worse by human behaviour. A significant portion of any large user base will pick passwords that follow a predictable corporate pattern — the company name, the current season, a memorable year, or a word the IT department told everyone to use as a base. When an attacker lists Acme2026!, Summer2026!, and Welcome1 as their spray candidates, they are not guessing randomly. They are working from a well-understood model of how people construct memorable, policy-compliant passwords.
“Password spraying is one of the most pervasive techniques used by threat actors to gain unauthorised access to enterprise environments. Multi-factor authentication remains the most effective single control.” — CISA Advisory AA23-347A, Cybersecurity Advisory on Common Initial-Access Techniques
Password spraying vs brute force vs credential stuffing
These three attack categories are often conflated, but they have meaningfully different mechanics and require different defences.
| Attack type | Passwords per account | Accounts targeted | Primary input | Defeated by lockout? |
|---|---|---|---|---|
| Brute force | Many (exhaustive) | One | Generated guesses | Yes |
| Credential stuffing | Known pairs | Many | Leaked username:password pairs | Partially |
| Password spraying | 1–3 per round | Many (thousands) | Valid username list + common passwords | No |
Credential stuffing relies on already-leaked password pairs and is defeated whenever a user has a unique password per service. Password spraying needs no prior breach — it only needs a list of valid usernames (easily harvested from LinkedIn, company directories, or email-format guessing) and the knowledge that some fraction of users will have chosen a predictable password.
How a spray attack unfolds in practice
Understanding the step-by-step execution helps teams configure the right detections. A typical spray campaign works as follows:
- Username enumeration. The attacker collects valid email addresses or usernames from LinkedIn, public company pages, or by guessing the organisation's email format (
[email protected]). Many identity providers inadvertently confirm valid usernames through differing error messages or response times. - Candidate password selection. The attacker selects one to three passwords that fit the target's likely password policy: usually a capitalised word, a number, and a special character. Common picks include the organisation's name, the current month and year, and generic corporate standbys like
Welcome1orP@ssw0rd. - First spray round. Password one is tested against every account in the list. Because there is only one attempt per account, no lockout is triggered. A single successful authentication gives the attacker valid credentials and an initial foothold.
- Waiting. Most lockout policies reset the failed-attempt counter after a fixed observation window (typically 30–60 minutes). The attacker waits out this window before proceeding.
- Subsequent rounds. Password two, then password three, are sprayed in the same way. The attacker needs to compromise only a single account to begin lateral movement.
How to detect a password spraying attack
Because each individual account sees only one or two failed logins, spray attacks produce a distinctive pattern in aggregate that differs from the noise of normal forgotten-password events. Your SIEM or identity provider should alert on:
- Distributed failed logins across many accounts within a short window — especially if the failure timestamps are evenly spaced (a sign of automated tooling).
- A single source IP or a small set of IPs associated with failures across many user accounts.
- A spike in failures followed by one or more successes — the classic spray-then-land pattern.
- Auth failures from unexpected geolocations or from IP ranges belonging to anonymisation services such as Tor or commercial VPNs.
- User-agent strings that differ from your normal client population — automated spray tools often use default or missing user-agent headers.
Modern identity providers including Microsoft Entra ID, Okta, and Ping Identity include native spray-detection heuristics. If you run an on-premises Active Directory, Microsoft Advanced Threat Analytics and similar SIEM integrations can surface the same signals from domain controller logs (event ID 4625 at scale). Enable and tune these alerts before you need them — not after.
How to prevent password spraying
Defending against password spraying requires a layered approach because no single control is complete on its own.
1. Enforce multi-factor authentication everywhere
MFA is the most important control. A valid username and password combination is useless to an attacker if the account also requires a time-based one-time password, a push notification approval, or a hardware security key. CISA, NCSC, and virtually every major security framework list MFA as the primary mitigation for credential-based attacks. If you can implement only one control from this list, it is this one.
2. Ban commonly-used passwords at enrolment
Spray attacks succeed because users choose predictable passwords. The direct fix is to reject those passwords before they are ever set. NIST SP 800-63B is explicit on this point:
“When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised. If the chosen secret is found in the list, the verifier SHALL advise the subscriber that they need to select a different secret.” — NIST Special Publication 800-63B, Section 5.1.1.2
Maintain a custom banned list that includes your organisation's name, product names, location names, and seasonal patterns specific to your industry, on top of any publicly available common-password corpus. Review and extend the list at least annually.
3. Tune lockout policies with smart thresholds
A lockout policy that triggers after five failed attempts in 30 minutes does not stop spraying — it stops brute force. To make lockout useful against spraying, consider policies that aggregate failed attempts across the identity provider (not just per-account) and trigger alerts or CAPTCHA challenges when the ratio of failures to successes across all accounts exceeds a normal baseline. This is sometimes called "soft lockout" or "sign-in risk score escalation" in modern IdP terminology.
4. Eliminate password reuse with a password manager
If every user has a unique, randomly-generated password per account — 20 characters of mixed characters with no recognisable pattern — there is no common password for a spray to hit. The challenge is making this realistic for end users. A zero-knowledge password manager like NordPass generates and stores strong unique credentials automatically, so users never need to invent or remember a password that conforms to any spray-friendly pattern.
5. Enable sign-in risk detection in your identity provider
If your organisation uses a cloud identity platform, enable its built-in risk-based authentication features. Microsoft Entra ID's Identity Protection, Okta ThreatInsight, and Google Workspace's login challenge system all have heuristics specifically designed to detect and interrupt spray attempts in real time. These controls can require step-up authentication or block logins automatically when a spray pattern is detected, buying your security team time to respond.
6. Monitor and respond to anomalous authentication events
Detection without response is noise. Ensure your SIEM generates actionable alerts, and that those alerts have a defined response playbook. At minimum, a spray detection should trigger: account investigation, password reset for any account that authenticated during or after the spray window, and a review of any downstream access by those accounts.
What does password spraying mean for individual users?
This threat is not limited to enterprise environments. Attackers spray consumer services — email providers, social platforms, online banking — in exactly the same way. For individuals, the defences are the same as for organisations: a unique, random password per service (generated by a tool like this one or stored in a manager) makes you effectively immune to spraying. If your password for any given service is not present on any common-password list and does not follow any guessable pattern, a spray will never land on your account regardless of how many others it hits.
If you want to know whether any of your existing passwords have already been exposed in a breach — and therefore available as spray candidates — the k-anonymity breach-checking technique lets you query a database of over 850 million compromised credentials without sending your password anywhere.
Frequently asked questions
What is a password spraying attack?
A password spraying attack is a credential attack where an adversary tests one or a small number of commonly-used passwords across thousands of valid accounts, keeping the attempt count per account low enough to avoid triggering lockout policies. It is the inverse of a brute-force attack, which tries many passwords against a single account.
How is password spraying different from brute force?
Brute force exhausts many passwords against one account and is stopped by lockout. Password spraying tries one password against many accounts and bypasses lockout entirely because each account only ever sees a single failed attempt per spray round.
What is the best defence against password spraying?
Multi-factor authentication is the most effective single control: even a valid password cannot complete authentication without the second factor. Supporting defences include banning common and predictable passwords at enrolment (as required by NIST SP 800-63B), deploying sign-in risk detection in your identity provider, and ensuring users have unique, randomly-generated passwords that follow no predictable pattern.