Secordit home
Contact

What is a dictionary attack?

Dictionary attacks try passwords from a list of words, common passwords and predictable variations, rather than every possible combination of characters. The NCSC explains this in the context of stolen password hashes. An attacker can run a list of known words, including common substitutions, through the same hash function and see whether any match. 12

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

  1. A list of words, common passwords and predictable variations is prepared. 12
  2. Those guesses are tried against a login, or compared with stolen password hashes. 1
  3. A brute-force attack, in the same NCSC explanation, tries every possible combination, which is harder against a longer, less predictable secret. 1

How it can look

The NCSC's three random words blog describes dictionary attacks and brute force in that hash comparison. For people, the useful idea is already in that guidance: do not use a single common word or a predictable pattern. A password manager, or three random words where a manager is not used, is the NCSC's direction. This page explains the idea for people choosing a password, not the technical detail of hashing. 12

Warning signs

  • A password is a single common word, a name, or a predictable pattern with a simple substitution, such as swapping a letter for a number. 12
  • An organisation does not block common passwords, and has no throttling or MFA on internet-facing logins. 2
  • Advice focuses only on adding more special characters, which is not the NCSC's main direction. 12

What to do now

  1. Use a password manager so that you are not choosing a single common word or a predictable pattern. 12
  2. If you are not using a manager, follow the NCSC's three random words direction, rather than a single dictionary word. 1
  3. Turn on MFA or a passkey, and if you manage logins, block common passwords and use throttling as in the NCSC password guidance. 2

UK reporting and support

  • If you think an account has been taken over, follow the NCSC help for a hacked account. 3
  • For fraud or hacking in England, Wales or Northern Ireland, use Report Fraud. In Scotland, call Police Scotland on 101. 467
  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 5
  • If someone is in danger, call 999. 67

How to protect yourself

  • Avoid a single common word or a predictable pattern, including simple substitutions. 1
  • Use a password manager, or three random words where a manager is not used. 1
  • Add MFA or a passkey, and block common passwords on any login you manage. 2

Frequently asked questions

Is a dictionary attack the same as a brute-force attack?

No. A dictionary attack uses a list of words, common passwords and predictable variations. In the same NCSC explanation, a brute-force attack tries every possible combination, which is harder against a longer, less predictable secret. 1

Does adding special characters fix this?

The NCSC direction is not to treat extra special characters as the main defence. Do not use a single common word or a predictable pattern. Use a password manager, or three random words where a manager is not used. 12

How is this different from password spraying?

Password spraying tries a small number of commonly used passwords against many accounts. A dictionary attack is about guessing from a word list and predictable variations, including against stolen password hashes. 12

Matching kit

Account Lockdown Kit · £19 · Digital download.

A self-serve guide to securing email, phone and online accounts. It does not promise to stop every attack.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. NCSC, Three random words or #thinkrandom | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  2. NCSC, Password policy: updating your approach | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  3. NCSC, Help for individuals | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  4. Report Fraud, Report Fraud. Accessed 10 November 2026 (Europe/London).
  5. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 10 November 2026 (Europe/London).
  6. Police Scotland, How to report a crime - Police Scotland. Accessed 10 November 2026 (Europe/London).
  7. Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud. Accessed 10 November 2026 (Europe/London).