Password Spraying: How Attackers Try the Same Few Passwords Everywhere

The 30-second explanation

Instead of hammering one account until it locks, spraying tries 'Summer2025!' on thousands of accounts. Stuffing takes passwords leaked from one site and tries them on many others.

How it works

1. 1

   1. Collect

   Usernames or leaked pairs are gathered.

2. 2

   2. Automate

   Tools try logins at scale, slowly.

3. 3

   3. Succeed

   Some accounts use weak or reused passwords.

4. 4

   4. Use

   Attackers sign in as those users.

Attackers collect a list of usernames, often from email formats or previous leaks. In spraying, they try a small number of common passwords against each account, then wait, so lockouts do not trigger. In stuffing, they take real username and password pairs from breaches and test them on other services. Both work only because people choose weak passwords or reuse them, and both are made much harder by MFA and unique passwords.

Real-world example

How to spot it

• Failures across many accounts

  One source attempting many different users.

• Logins from odd places

  A success from a new country or hosting provider.

• Steady, low-rate attempts

  Just below the lockout threshold.

• Successes right after failures

  A pattern that suggests guessing.

What to do

1. 1Turn on MFA everywhere, and block common passwords when people choose them.
2. 2Alert on many accounts failing from one source, not just one account failing many times.
3. 3Encourage a password manager so nobody reuses a password across services.