What Is Password Spraying?
Your company's login page shows waves of failed sign-ins across many accounts — or your own account got locked after attempts you never made. That pattern is password spraying: attackers trying a few common passwords against many accounts, staying under lockout limits. Here is how it works and how to defend against it.
TL;DR / Quick Fix
Quick fix: password spraying tries common passwords against many accounts to dodge lockouts — the defense is multi-factor authentication, which stops sprayed passwords cold. Use a unique password per account from a manager, enable MFA everywhere important, and treat unexpected lockouts as a warning sign.
Follow these steps
- Recognize the pattern. Many accounts, few attempts each, common passwords — that is spraying. It differs from brute force, which hammers one account with many passwords. The compromised-password warning in your browser catches the fallout on the personal side.
- Understand why it works. Spraying exploits password reuse: one leaked common password opens every account that reused it. Attackers stay under lockout thresholds by trying each account only a few times.
- Enable multi-factor authentication. MFA is the hard counter — a sprayed correct password still fails without the second factor. Prioritize email, banking, and work accounts; authenticator apps beat SMS.
- Use unique passwords everywhere. A password manager makes uniqueness effortless. Spraying feeds on reuse; unique passwords starve it — even if one account's password leaks, the rest stand.
- Treat surprise lockouts as alerts. An account locked for attempts you did not make means someone is spraying it. Do not just unlock and move on — check for unfamiliar logins and strengthen that account.
- Watch for the account-takeover aftermath. If spraying succeeded somewhere, the signs are changed credentials or unfamiliar sessions. Review active sessions in important accounts monthly.
What to avoid
- Do not reuse passwords across important accounts. Reuse is the single habit password spraying exploits — uniqueness defeats the entire technique.
- Do not rely on lockout policies alone. Sprayers deliberately stay under lockout limits; the policy you trust is the one they designed around.
- Do not use predictable 'strong-looking' passwords. Welcome123 and Company2024 are the first guesses in every spray list — uniqueness beats complexity theater.
- Do not ignore MFA prompts you did not trigger. An unexpected code request means someone has your password right now — deny it and change the password immediately.
Frequently asked questions
Is password spraying illegal?
Yes — unauthorized login attempts are illegal in most jurisdictions. This guide covers recognizing and defending against it, which is the legitimate side.
How is this different from brute force?
Brute force tries many passwords on one account and trips lockouts; spraying tries few passwords on many accounts and slips under them. Different shape, same goal.
Will a long password stop it?
A unique long password stops your account falling to it. But only MFA stops the attempt from mattering even when a password is guessed — use both.