Secordit home
Contact

What is password spraying?

Password spraying uses a small number of commonly used passwords in an attempt to access a large number of accounts. That is the NCSC's definition. It is the reverse shape of a classic brute-force attack, which tries many guesses against one account, and it is also different from credential stuffing. 12

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

  1. A small set of common passwords is tried against many accounts, rather than many guesses against one account. 12
  2. The aim is to find accounts that still use one of those common passwords, often without triggering a single-account lockout. 1
  3. Organisations are told to use throttling or lockout, monitoring (including for spraying), blocking of common passwords, and MFA on important and internet-facing accounts. 12

How it can look

The NCSC password guidance contains this definition and the monitoring advice. Its identity and access management guidance mentions password spraying alongside brute-forcing. For people, unique passwords via a password manager, plus MFA or passkeys, reduce the chance that a common password opens an account. 12

Warning signs

  • People in a team still use a short common password, such as a season or a company name, especially on an internet-facing login. 1
  • A workplace login has no monitoring for this pattern, and no MFA on important accounts. 12
  • A lockout on one account is treated as proof of spraying, which it is not, on its own. 1

What to do now

  1. Use a password manager so that you are not relying on a common password. 1
  2. Turn on MFA or a passkey for important and internet-facing accounts. 12
  3. If you manage logins, follow the NCSC guidance: throttle guesses, monitor for spraying, and block common passwords. 1

UK reporting and support

  • If you think an account has been taken over, follow the NCSC help for a hacked account. 3
  • For fraud or hacking in England, Wales or Northern Ireland, use Report Fraud. In Scotland, call Police Scotland on 101. 467
  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 5
  • If someone is in danger, call 999. 67

How to protect yourself

  • Avoid common passwords, and use a password manager to store a unique password for each account. 1
  • Add MFA or a passkey on important accounts. 12
  • If you run a workplace login, monitor for spraying and block commonly used passwords. 1

Frequently asked questions

How is password spraying different from a brute-force attack?

Password spraying tries a small number of common passwords against a large number of accounts. A brute-force attack tries a large number of guesses against one account. 12

How is it different from credential stuffing?

Credential stuffing reuses passwords already leaked from another breach. Password spraying uses a small number of commonly used passwords, not a stolen list from a previous site. 1

If my account is locked, is that password spraying?

Not necessarily. Lockout can also follow ordinary typing mistakes or other guessing. The NCSC advice is to monitor for spraying, but a lockout on its own does not prove it. 1

Matching kit

Account Lockdown Kit · £19 · Digital download.

A self-serve guide to securing email, phone and online accounts. It does not promise to stop every attack.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. NCSC, Password policy: updating your approach | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  2. NCSC, 10 Steps: Identity and access management | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  3. NCSC, Help for individuals | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  4. Report Fraud, Report Fraud. Accessed 10 November 2026 (Europe/London).
  5. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 10 November 2026 (Europe/London).
  6. Police Scotland, How to report a crime - Police Scotland. Accessed 10 November 2026 (Europe/London).
  7. Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud. Accessed 10 November 2026 (Europe/London).