Brute Force vs Password Spraying
The shop's website admin page logs show thousands of failed logins overnight. Some hit one account over and over; others try a single password on every account. Both are guessing attacks, but they behave differently, so the defences need to cover both.
The rule
Brute force hammers one account; spraying tries one password on many.
- Brute force — many guesses against one account. Loud and easy to notice, and stopped by lockouts and slowing down repeated attempts.
- Password spraying — a few very common passwords, like a season plus a year, tried once against many accounts. Each account sees only one or two failures, so simple lockouts do not trigger.
- Credential stuffing — reusing username and password pairs leaked from other websites, betting that people reuse passwords.
What they have in common: they only work when passwords are guessable or reused, and when a password is the only thing needed.
Defences, in order of impact:
- MFA — a guessed password alone is no longer enough.
- Long, unique passwords — a passphrase of several random words, different on every site, kept in a password manager.
- Block common and leaked passwords when people choose them.
- Rate limiting and lockouts — slow down or pause repeated failures.
- Monitoring — watch for many failures across many accounts, the signature of spraying.
The shortcut
Look at the failed logins and ask "many tries on one account, or few tries on many accounts?" One account: brute force, lockouts help. Many accounts: spraying, only strong unique passwords, MFA and pattern monitoring help.
Pattern A
2,000 failures against the
adminaccount alone. Brute force. The lockout already paused it.
The trap is making people change passwords every month. It pushes them toward predictable patterns like adding the month. Length, uniqueness and MFA work better.
Drills
Answer fast — trust the rule.
An attacker tries the password Summer2026! once on every account in the shop. What is this?
Why does a simple account lockout often fail to stop password spraying?
Leaked email and password pairs from another website are tried on the shop's site. What is this called?
Which single defence most weakens all three guessing attacks?
Remember
- Brute force hammers one account; spraying tries one password on many; stuffing reuses leaked pairs.
- Ask "many tries on one, or few tries on many?" and defend both.
- Use MFA, long unique passwords in a manager, and monitoring. Trap: forced monthly changes.