Dictionary Attack Explained:How It Works and Defences
Summer2026!. It is far faster than pure brute force because it only tries passwords people actually use. The defences are the same ones that stop other password attacks: block breached and common passwords, add rate limiting and MFA, and store passwords with a slow hash.Most password guessing you read about in the news is really a dictionary attack. Pure brute force, which tries every possible character combination, is far too slow against a decent password. So attackers work smarter: they guess from lists of passwords that real people choose. This guide explains how a dictionary attack works, how it differs from brute force and password spraying, and how to stop it. It pairs with our overview of the three password attacks compared.
What Is a Dictionary Attack?
A dictionary attack is a password guessing method that works through a wordlist: a file of likely passwords prepared in advance. Rather than trying aaaa, aaab, aaac and so on, it tries password, 123456, qwerty, and millions of other passwords that people have actually used. The name comes from the original idea of using a language dictionary, but modern wordlists are far more than dictionaries. They are built from real breaches, so they contain the exact passwords humans pick, including ones with numbers and symbols added.
How Does a Dictionary Attack Work?
The attack has three simple stages, and it can run either against a live login page (online) or against a stolen password database (offline).
- Build or download a wordlist. Attackers use ready-made lists such as rockyou.txt, or lists of passwords from recent breaches, often millions of entries long.
- Apply mangling rules. Tools automatically transform each word: adding a year, swapping
afor@, capitalising the first letter, appending!. This turnspasswordinto thousands of realistic variants. - Try each candidate. Online, the attacker sends guesses to the login form. Offline, they hash each candidate and compare it to the stolen hashes, which is extremely fast if the passwords were stored with a weak hash.
# A wordlist plus mangling rules, not every combination
password -> Password1, P@ssw0rd, password2026, Password!
summer -> Summer2026!, summer123, $ummer
qwerty -> Qwerty1, qwerty!, qwerty2026
# Only realistic guesses are tried, so it is fastHow Is a Dictionary Attack Different From Brute Force?
People often use the two terms as if they mean the same thing, but there is a clear difference in strategy.
| Method | What It Tries | Speed | Weakness It Exploits |
|---|---|---|---|
| Dictionary attack | A prepared list of likely passwords, plus variations | Fast: only realistic guesses | People choose common, predictable passwords |
| Pure brute force | Every possible character combination in order | Very slow against long passwords | Short or simple passwords only |
| Password spraying | A few common passwords across many accounts | Low and slow per account | Weak passwords plus per-account lockout gaps |
In practice, pure brute force is rare because it cannot finish against a strong password in any reasonable time. A dictionary attack is the practical version: it skips the impossible combinations and spends its effort on the passwords people really use. Password spraying is essentially a dictionary attack spread thinly across many accounts to dodge lockout, and credential stuffing is the extreme case where the wordlist is real username and password pairs.
Why Are Dictionary Attacks So Effective?
- People reuse a small set of passwords. A wordlist of the few million most common passwords covers a large share of real accounts.
- Mangling rules mirror human habits. The tricks people use to feel secure, like adding a year or a
!, are exactly what the rules generate. - Offline cracking is fast with weak hashes. If a leaked database used MD5 or SHA-256, an attacker can test billions of dictionary candidates per second.
- Breaches keep the lists fresh. Every new breach adds real passwords to the wordlists, so the guesses get better over time.
How Do You Defend Against a Dictionary Attack?
Because a dictionary attack targets predictable passwords, the strongest defence is to make sure no account uses one, and then to slow down and block automated guessing.
- 1Block breached and common passwords at signup and password change using the HaveIBeenPwned Pwned Passwords API, so wordlist entries can never be set as passwords.
- 2Encourage long passphrases and screen new passwords with a strength library such as zxcvbn.
- 3Enforce multi-factor authentication, so a guessed password alone cannot complete a login.
- 4Add rate limiting and account lockout to slow online guessing to a crawl.
- 5Store passwords with a slow, salted hash such as Argon2id or bcrypt, so an offline dictionary attack on a stolen database is not practical.
- 6Log and alert on repeated failed logins so you can spot an online attack in progress.
- 7Ban predictable patterns like season plus year and company name plus digits, which mangling rules generate first.
Two of these controls do most of the work. Blocking breached passwords removes the wordlist targets from your system entirely, and storing passwords with a slow salted hash makes offline cracking too expensive to be worth it. For the hashing side, see our guide on password hashing with bcrypt and Argon2.
What Does OWASP Say About Dictionary Attacks?
OWASP treats dictionary attacks as a form of brute force and addresses them in the Authentication Cheat Sheet and the ASVS authentication controls. The guidance is to block common and breached passwords, rate limit authentication endpoints, offer multi-factor authentication, and store passwords with a strong adaptive hashing function. OWASP and NIST both recommend checking new passwords against known breach corpora rather than forcing complex character rules, because complexity rules push users toward exactly the predictable patterns that dictionary attacks try first.