Dictionary Attack Definition

A dictionary attack is a type of password attack where an attacker tries to guess a password using a list of common words, phrases, or known password combinations. These lists often include everyday terms, simple patterns, and passwords exposed in past data breaches.

Instead of testing every possible combination, a dictionary attack focuses on passwords people are most likely to use. This can be effective because many passwords follow predictable patterns. It's commonly used to gain access to online accounts, systems, or password-protected files.

How Dictionary Attacks Work

A dictionary attack uses automated tools to test a list of password guesses against a target account or system. These tools can send many login attempts in a short time, one after another. Attackers often expand their lists by making small variations, like adding numbers, switching letters to symbols, or changing capitalization. This is often called a hybrid attack, where common words are modified to better match real-world password patterns. They may also tailor the list for a specific target by including names, locations, or other details linked to a person or organization.

In some cases, dictionary attacks happen offline. If an attacker gets access to stored password hashes, they can test a large number of guesses without restrictions such as rate limits or account lockouts.

Dictionary Attack vs Brute Force Attack

	Dictionary Attack	Brute Force Attack
Approach	Uses a list of likely passwords	Tries every possible combination
Total duration	Faster due to fewer options	Slower due to exhaustive search
Effectiveness	Works best on weak or reused passwords	Can eventually break any password
Resource use	Requires less computing power	Requires more time and processing

How to Prevent Potential Dictionary Attacks

• Use long, random passwords that don’t use common words, phrases, or predictable patterns.
• Avoid reusing the same password across multiple accounts.
• Enable multi-factor authentication (MFA) to add an extra layer of protection even if a password is guessed.
• Use a password manager to generate and store strong passwords.
• Limit login attempts, as it can help reduce how quickly guesses can be tested (it doesn’t protect against offline attacks using stolen password data).
• Apply strong hashing with techniques like salting (and optionally peppering) to make offline dictionary attacks much harder and slower.
• Monitor accounts for suspicious activity, unusual login alerts, or repeated login failures.

Read More

• What Is Credential Stuffing?
• What Is a Reverse Brute-Force Attack?
• What Is Strong Authentication?

FAQ