A dictionary attack is a password-guessing method that tries words, common passwords and leaked credentials from a prepared list instead of every possible character combination.
How a dictionary attack works
A dictionary attack is a smarter form of brute force. Instead of testing “aaaa”, “aaab” and so on, the attacker uses a wordlist: dictionary words, names, keyboard patterns and, above all, real passwords from earlier breaches. The best-known list, rockyou.txt, comes from the 2009 RockYou breach, in which over 32 million passwords were stored in plaintext.
Attacks come in two forms:
- Online – guessing against a live login page, VPN or SSH service (MITRE ATT&CK T1110.001). It is slow and easily noticed, so attackers often use password spraying: a few common passwords against many accounts.
- Offline – cracking stolen password hashes (T1110.002) with tools such as Hashcat or John the Ripper. Mangling rules add digits, capitals and character substitutions (“P@ssw0rd2024”), and GPUs test billions of candidates per second against fast hashes.
Why dictionary attacks matter
People choose predictable passwords and reuse them, so wordlists crack a large share of real accounts. Cracked passwords then feed credential stuffing against other services. Precomputed rainbow tables speed up attacks on unsalted hashes even further.
How to protect against dictionary attacks
- Block common and breached passwords at sign-up, as NIST SP 800-63B recommends, and favour long passphrases.
- Store passwords with slow algorithms such as bcrypt, scrypt or Argon2 and a unique salt.
- Rate-limit and monitor login attempts, and lock or challenge suspicious sources.
- Enable multi-factor authentication and use a password manager.
