A dictionary attack guesses passwords by trying a list of likely candidates, such as common words, leaked passwords and predictable variations, instead of every possible combination. Stop it by blocking known weak passwords, rate limiting attempts, requiring length and adding multi-factor authentication.
How does it work?
MITRE ATT&CK files this under Brute Force (T1110), where adversaries systematically guess passwords with a repetitive or iterative mechanism. Guessing can happen against a live service that checks credentials, or offline against password hashes the attacker already obtained. A dictionary attack is the smart version: the list is ordered by how likely each password is, so common choices are tried first.
ATT&CK separates four sub-techniques. Password guessing uses a list of common passwords against a known account. Password cracking recovers passwords offline from hashes. Password spraying tries one password, or a small list of common ones, against many accounts to avoid lockouts. Credential stuffing uses credentials leaked elsewhere. A dictionary can feed all four.
Why do these attacks still work?
People choose passwords that are easy to remember, so they cluster. Lists built from breach data, dictionary words and context words such as the service name or a username cover many real passwords. NIST's digital identity guidelines say as much: they require checking a new password against a blocklist of commonly used, expected or compromised values, including breach corpuses, dictionary words and context specific words, and they require the whole password to be compared, not substrings.
Spraying is harder to spot. One attempt per account stays below per-account lockout thresholds. ATT&CK notes commonly targeted services include SSH, RDP, LDAP, Kerberos, SMB, web management consoles and databases.
What stops a dictionary attack?
Blocklists. Reject passwords that appear on a list of common or breached values at the moment they are set.
Length over complexity. NIST SP 800-63B, revision 4, requires a minimum of 15 characters for passwords used alone, allows 8 where the password is only one factor in multi-factor authentication, and says other composition rules must not be imposed. Long passphrases are both easier to remember and harder to guess.
Rate limiting and throttling. Slow repeated attempts per account and per source. Watch for the same source trying many accounts.
Multi-factor authentication. ATT&CK lists MFA as a mitigation for brute force, because a guessed password alone no longer grants access. Prefer methods that resist phishing.
Slow password hashing. If hashes leak, a slow, salted hash makes offline guessing expensive. Do not use fast general purpose hashes for passwords.
Detection. Alert on bursts of failed logins, logins to many accounts from one address, and a first success after a long run of failures.
A constructed example
A small web app limits each account to five failed attempts. An attacker takes the 20 most common passwords and tries each against 10,000 accounts, one attempt per account per hour. Per-account lockout never triggers. The app owner adds a global alert on failed login volume, rejects the 20 passwords at registration and password change, and turns on MFA. The attack now yields few valid passwords and none that grant access.
How to check or apply this
- Add a blocklist check at registration and password change.
- Require at least 15 characters for password only accounts, and drop composition rules.
- Rate limit by account and by source, and alert on spraying patterns.
- Require MFA on admin, email and remote access first.
- Store passwords with a slow, salted hashing function.
- Log failed and successful authentications centrally.
- Check exposed management services and close ones that need not be public.
Quick check
Is a dictionary attack the same as brute force?
It is a form of brute force. Plain brute force tries all combinations in order. A dictionary attack tries a ranked list of likely passwords first.
Will account lockout stop it?
Not always. Spraying tries one password across many accounts to stay under per-account limits, so you also need source level limits and monitoring.
Sources
- MITRE ATT&CK T1110, Brute Force
- MITRE ATT&CK T1110.003, Password Spraying
- MITRE ATT&CK T1110.002, Password Cracking
- NIST SP 800-63B-4, Authentication and Authenticator Management
Last reviewed: 18 October 2026.
