Password spraying: one password, many accounts

Password spraying turns brute force on its side. Instead of trying many passwords against one account, the attacker tries one common password, or a short list, against many accounts. Each account sees one failed attempt, so per-account lockouts never trigger, and with enough accounts one of them is likely to use the password being tried.

Section Bots Updated 8 Oct 2026 Defined by MITRE ATT&CK T1110.003

Quick facts

Definition: A single or small list of commonly used passwords tried against many accounts (MITRE ATT&CK T1110.003)
Why it works: Common passwords are common, and per-account limits see only one attempt each
Typical targets: Single sign-on portals, webmail, VPN and remote access, any sign-in with many users
Seen in logs as: The same password failing across many accounts, often slowly
Best defences: Refusing common passwords, multi-factor authentication, limits across accounts

It is a form of brute force attack, tuned to avoid lockouts.

How password spraying works

The attacker collects user names. From email formats, public profiles or a previous breach.
It picks a few likely passwords. Seasonal patterns, the company name with a number, passwords that satisfy common complexity rules.
It tries one password across all accounts, slowly, and from many addresses, to stay below every threshold.
It waits, then tries the next password. Often longer than the lockout window, so counters reset.

The attack is patient by design. A few attempts per account per day is enough when there are thousands of accounts.

Password spraying vs brute force vs credential stuffing

Attack	Passwords tried	Accounts per password	Seen by per-account limits
Brute force	Many guesses	One	Yes
Password spraying	A few common ones	Many	No
Credential stuffing	Pairs leaked from other sites	One pair per account	Rarely

Credential stuffing uses real, leaked passwords; spraying uses guesses that are merely popular. See credential stuffing.

// three attacks, four defences

How to detect password spraying

Failures spread across many accounts in a short period, each with only one or two attempts.
Many failures for accounts that do not exist, because user lists are guessed.
The same client fingerprint or timing pattern across many different accounts and addresses.
A rise in failures after each lockout window, matching the attacker's pacing.

Detection needs totals across accounts, not counters per account. Without them, the attack is invisible by design.

Why single sign-on is a favourite target

A single sign-on portal guards many applications behind one set of credentials, and every employee has an account. That gives an attacker a long list of user names, predictable from email addresses, and a single place to try them.

Older protocols that still accept a plain password, such as legacy mail access, often sit beside the portal without its protections. Spraying goes to whichever door has the fewest checks, so all of them need the same rules.

How to prevent password spraying

Refuse common and compromised passwords. NIST SP 800-63B asks verifiers to check new passwords against such lists.
Require multi-factor authentication. A correct guessed password is then not enough.
Limit attempts across accounts, not only per account, as the OWASP Credential Stuffing Prevention Cheat Sheet describes.
Answer the same way for unknown and known users. So user lists cannot be confirmed by the error message.
Watch single sign-on and legacy protocols, which often bypass the protections on the main sign-in page.

Questions

What is password spraying?

Password spraying is trying one or a few common passwords against many accounts, so each account sees only one failed attempt and lockouts do not trigger.

What is the difference between password spraying and credential stuffing?

Password spraying tries popular guesses across many accounts. Credential stuffing tries real username and password pairs leaked from other sites.

How do you detect password spraying?

Look across accounts: many accounts with one or two failures each in a short period, failures for non-existent users, and the same client pattern across many accounts.

How do you prevent password spraying?

Refuse common passwords, require multi-factor authentication, limit attempts across accounts as well as per account, and give identical responses for known and unknown users.