thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Security Fundamentals & Crypto

Brute Force vs Dictionary Attack vs Password Spraying

A brute-force attack tries every possible combination, a dictionary attack tries words from a list of likely passwords, and password spraying tries a few common passwords against many accounts to avoid lockouts.

Brute-Force Attack

Full definition
vs

Dictionary Attack

Full definition
vs

Password Spraying

Full definition
Brute-Force AttackDictionary AttackPassword Spraying
Guess sourceEvery combinationWordlist of likely passwordsA handful of very common passwords
Accounts targetedUsually oneUsually oneMany
Triggers lockout?Likely if onlineLikely if onlineDesigned to avoid it
Speed to successSlow but guaranteed eventuallyFast if password is commonFast at scale if any user is weak
Detection clueMany failures on one accountMany failures on one accountOne or two failures across many accounts from one source
DefenseLong passwords, lockout, MFABanned password lists, lockout, MFAMFA, smart lockout, monitoring for distributed failures
Remember it

Brute force tries everything, dictionary tries the likely, spraying tries one key on every door.

Exam tip

If logs show one failed login per account across hundreds of accounts, the answer is password spraying. Offline cracking of stolen hashes avoids lockouts entirely.

Tested on

More Security Fundamentals & Crypto look-alikes