Password spraying is a brute-force attack that tries a small set of common passwords against many accounts at once, staying under the lockout thresholds that would stop a normal guessing attack. It is one of the most reliable ways into an enterprise because it exploits the gap between per-account security controls and organization-wide visibility. No single account looks like it is under attack, so nothing trips.
This guide covers how password spraying works, why it keeps succeeding, and how to detect, prevent, and respond to it. The short version: the fix is not a better lockout policy, it is removing the password as the thing worth guessing. For the wider set of techniques that target credential systems, our overview of common authentication attack vectors maps where spraying sits among phishing, credential stuffing, and the rest.
Key Takeaways
- Password spraying inverts brute force. Instead of many guesses against one account, it sends one common password across many accounts, so per-account lockouts and alerts never fire.
- The damage is lateral, not local. A single cracked account in a federated single sign-on environment unlocks every connected app behind it.
- Legacy protocols are the favorite door. IMAP, POP3, and SMTP rarely enforce MFA, so attackers hunt those endpoints to bypass the modern controls you deployed everywhere else.
- Passkeys end the attack outright. When there is no password in the flow, there is nothing to spray, and the technique becomes irrelevant against protected accounts.
- Detection is a correlation problem, not a threshold problem. You find a spray by aggregating failed logins across the entire population, not by watching individual accounts.
What Is Password Spraying?
Password spraying is a type of brute-force attack where an attacker tries a small number of common passwords against many user accounts at once. The defining trait is the low-and-slow pattern: instead of hammering one account with thousands of guesses, the attacker tests one password across hundreds or thousands of accounts, then moves to the next password.
Why does this matter? Most organizations lock an account after a handful of failed attempts. Spraying sidesteps that protection entirely. By spreading guesses thin and pausing between attempts, the attacker stays below the threshold that would trigger a lockout or an alert on any one account. The control is working exactly as designed, and it still misses the attack.
How Does a Password Spraying Attack Work?
A spray runs in five stages, from building a target list to escalating access after the first account falls. Each stage is tuned to stay quiet.
Step 1. Compile a List of Valid Usernames
Every spray starts with a target list. Attackers gather valid usernames or email addresses through LinkedIn scraping, OSINT tooling, or purchased breach data. Some login pages help by returning different errors for "user not found" versus "wrong password," which quietly confirms which accounts are real.
Step 2. Select a Small Set of Common Passwords
With a username list in hand, attackers pick passwords that are statistically likely to land. They pull from leaked credential databases and lean on patterns that repeat everywhere:
- Seasonal variations: "Summer2024!", "Winter2023"
- Company name combinations: "Acme123!", "AcmeCorp2024"
- Keyboard walks: "Qwerty123", "1qaz2wsx"
- Evergreen defaults: "Password1", "Welcome1!", "Changeme123"
Step 3. Attempt Logins Across Many Accounts
Here is the spray. The attacker tries the first password against every account on the list. Only after that full sweep do they move to the second password. One password, many accounts. That is the whole pattern, and it is what keeps each account under its lockout ceiling.
Step 4. Rotate IPs and Throttle Attempts to Evade Detection
Sophisticated attackers do not send everything from one IP. They distribute traffic across botnets, residential proxies, and cloud infrastructure, and they space attempts minutes or hours apart. The result reads like ordinary background noise of failed logins rather than a coordinated attack.
Step 5. Escalate Access After a Successful Login
Once a single account falls, the real work begins. Attackers pivot into federated SSO to reach connected applications, search mailboxes for credentials or sensitive documents, and probe for privilege escalation. A single compromised account is rarely the goal. It is the entry point for a much larger breach.
Password Spraying vs Brute Force vs Credential Stuffing
The three attacks all target authentication, but they differ in method and password source. Spraying uses few passwords against many accounts, brute force uses many passwords against one account, and credential stuffing replays passwords already known to be valid.
| Attack Type | Method | Password Source | Detection Difficulty |
|---|
| Password Spraying | Few passwords, many accounts | Common, guessed passwords | Hard (low volume per account) |
| Brute Force | Many passwords, one account | Generated combinations | Easy (triggers lockout fast) |
| Credential Stuffing | Known credentials, many services | Breached username/password pairs | Moderate (depends on reuse) |
The line between spraying and credential stuffing comes down to the password source. Spraying guesses passwords from common patterns. Stuffing replays pairs already proven valid in an earlier breach, which is why breached password detection and spray defenses are complementary, not interchangeable.
- Stolen credentials still appear at some point in 39% of all breaches
- Credentials account for 52% of all data compromised in basic web application attacks
2026 Verizon Data Breach Investigations Report
Common Passwords Used in Password Spraying Attacks
Attackers rely on predictable human behavior. When people create passwords, they take the same mental shortcuts, and attackers know exactly what those shortcuts look like. Seasonal patterns rank high because quarterly rotation policies push users to append the current season or year. Company-name variations show up because users assume their employer's name makes a password unique. Keyboard walks persist because they feel random but sit near the top of every attacker's list.
Analysis of breached credential databases keeps finding the same patterns across millions of accounts. That is why spraying stays effective even against organizations that believe their password policy is strong. Blocking weak choices at the source, using something like the recommended Argon2 parameters for password hashing alongside a compromised-password check, does more than a longer minimum length ever will.
Systems and Protocols Targeted by Password Spraying
Spraying concentrates on the endpoints where a single win pays off the most or where MFA is weakest. Four categories dominate the target list.
Cloud Identity Providers and SSO Portals
Microsoft 365, Google Workspace, and Okta portals sit at the top. The appeal is simple: one compromised account in a federated enterprise SSO environment can unlock dozens of connected applications with no further authentication. The identity provider that centralizes your access also centralizes the payoff.
Legacy Authentication Protocols
Older protocols like IMAP, POP3, SMTP, and legacy Exchange ActiveSync often lack MFA support entirely. Attackers specifically hunt these endpoints because they route around whatever modern protection sits on the web login. An organization can require MFA for browser sign-in and still leave IMAP wide open, and the spray goes straight through the gap.
VPNs and Remote Access Gateways
Internet-exposed VPN endpoints protected by only a username and password remain common. VPN access is especially valuable because it hands the attacker network-level reach once compromised, not just one application. Putting an identity-aware proxy in front of internal services limits how far that first foothold travels.
Machine, Service, and AI Agent Accounts
Non-human identities are a fast-growing target. Service accounts, API credentials, and AI agents often run on static credentials with elevated permissions, and they rarely have MFA. Ory's 2026 community survey saw machine-to-machine authentication debut as a use case for nearly a third of respondents (29.7%), and as teams wire up more AI agent identity, this category keeps expanding. Every agent with a guessable static secret is an account a spray can reach.
Why Password Spraying Is Effective
Spraying works because it exploits several weaknesses at once, and each one covers for the others:
- Weak password policies: many organizations still permit passwords that appear on common lists.
- Lockout design: slow, distributed attempts stay below per-account detection thresholds.
- Legacy endpoint gaps: MFA is often not enforced on older protocols or secondary paths.
- Human predictability: users pick memorable passwords, which means guessable ones.
- Visibility limits: attacks spread across thousands of accounts are far harder to correlate than a concentrated one.
Put those together and spraying becomes a reliable technique. Attackers keep using it because it keeps working, and it keeps working because most defenses are still watching the wrong unit of analysis.
Harden Your Login Flows With Ory
How to Detect a Password Spraying Attack
You detect a spray by looking across accounts, not down into one. The signal lives in the aggregate: many accounts, each with a few failures, from sources that do not belong.
High Volume of Failed Logins Across Many Accounts
The signature is failed authentication spread thin across many accounts inside a short window. Per-account monitoring misses this entirely, because no single account looks abnormal. Aggregate the failures and the pattern jumps out.
Distributed Source IPs and Anonymizing Infrastructure
Login attempts from VPN exit nodes, Tor, or cloud hosting ranges deserve scrutiny, especially across unusual geographies. A wave of failures from dozens of different cloud-provider IPs is a strong tell for automated attack infrastructure.
Low and Slow Authentication Patterns
Attackers space attempts minutes or hours apart to dodge rate limits. Catching that means aggregating authentication logs over longer windows and looking for distributed patterns rather than sudden spikes.
Spikes in Legacy Protocol Authentication
A sudden rise in IMAP or SMTP authentication, particularly at an organization that has otherwise moved to modern clients, usually means someone is probing legacy endpoints. If you have retired legacy auth for humans, any remaining legacy traffic becomes a clean signal worth alerting on.
How to Prevent Password Spraying Attacks
Prevention works in layers, but the highest-leverage move is removing the password as the thing worth guessing. The rest reduces the blast radius while you get there.
- Enforce Phishing-Resistant MFA and Passkeys: MFA sharply cuts a spray's success rate, because the password alone is no longer enough. Passkeys and WebAuthn go further by removing the password from the flow entirely. When there is nothing to guess, spraying becomes irrelevant against protected accounts. Ory Kratos ships passwordless authentication and passkeys as core capabilities rather than add-ons.
- Eliminate Common and Breached Passwords: Policies that block known-compromised passwords at registration and reset stop users from choosing the exact strings attackers try first. Several open databases of breached passwords exist for precisely this check, and wiring one into your signup flow closes the easiest path a spray has.
- Apply Rate Limiting and Adaptive Lockout Policies: Lockout logic that considers failures across many accounts, not just per-account thresholds, can spot spray patterns before they land. The goal is to detect the distributed shape that traditional per-account lockouts are blind to.
- Block Legacy Authentication Endpoints: Disabling IMAP, POP3, and SMTP authentication where you can removes the endpoints attackers lean on to bypass MFA. Where legacy access is still required, restrict it to known IP ranges or add a second factor so the bypass costs something.
- Deploy Adaptive and Risk-Based Authentication: Contextual signals like location, device fingerprint, and behavior can trigger a step-up or block a suspicious attempt. Adaptive authentication catches attacks that hide under static thresholds by scoring risk on every login instead of trusting a fixed rule.
- Monitor Authentication Signals at Scale: Feeding authentication logs into a SIEM and correlating events across accounts surfaces the spray patterns per-account monitoring cannot. The discipline is to watch the whole population, not the outliers on individual accounts.
How to Respond to a Password Spraying Attack
If a spray is already underway, response runs in four steps: contain, reset, investigate, and harden. Move in that order so you stop the bleeding before you close the wound.
Step 1. Contain the Attack and Block Malicious IPs
Block identified source IPs and suspicious ranges at the firewall or WAF. If the attack is distributed, temporarily raising authentication friction for everyone can buy time while the investigation runs.
Step 2. Reset Credentials for Affected Accounts
Force resets for any account that logged in successfully during the attack window, plus accounts that showed suspicious activity. Treat every account that authenticated during the spray as potentially compromised until proven otherwise.
Step 3. Investigate Scope and Confirm Lateral Movement
Review logs for post-compromise activity: mailbox access, privilege changes, new OAuth grants, data exfiltration. Compromised accounts become pivot points, so tracing what happened after access matters as much as finding the initial break.
Step 4. Harden Authentication and Close the Root Cause
Turn on MFA where it was missing, disable legacy protocols where you can, and update password policy to block commonly sprayed strings. The point is to close the gaps that made the attack possible, not just to evict this attacker.
Building Spray-Resistant Authentication With Modern IAM
Password spraying exploits assumptions baked into legacy authentication: that the password is the primary credential, that lockout only considers individual accounts, and that every endpoint enforces the same controls. Modern IAM removes those assumptions. API-first design enforces consistent policy across every flow, adaptive authentication scores risk on each attempt, and passkeys take the password out of the equation.
Ory's modular approach gives you the building blocks without a rip-and-replace: Ory Kratos identity management for passwordless login, an IAM security foundation for consistent policy, and flexible deployment across open source, self-hosted, or Ory Network managed IAM. You close the spray surface incrementally instead of betting the business on one migration.
We coupled the decision to move to Ory with a larger redesign of the signup experience that produced a statistically significant 15% lift in account creation conversions.
— Jeremiah Atwood, Head of Engineering, Cofertility
Ship Passwordless Auth With Ory Kratos
Frequently Asked Questions About Password Spraying
Is Password Spraying Illegal?
Yes. Password spraying is an unauthorized access attempt and violates computer-fraud laws in most jurisdictions, including the Computer Fraud and Abuse Act (CFAA) in the United States.
What Is the Difference Between Password Spraying and Brute Force?
Brute force throws many passwords at one account and trips its lockout quickly. Spraying throws one common password across many accounts, staying under each account's lockout threshold, which makes it far harder to detect.
Can Password Spraying Bypass Multi-Factor Authentication?
Not when MFA is properly enforced. Attackers get around it by targeting legacy endpoints where MFA is not applied, which is why disabling legacy authentication protocols matters as much as turning multi-factor authentication on.
How Long Does a Typical Password Spraying Attack Last?
Days or weeks. Attackers deliberately slow their attempts to stay under detection thresholds, so an organization may not notice an ongoing spray without log aggregation and cross-account analysis.
Do Passkeys Eliminate the Risk of Password Spraying?
Yes. Passkeys remove the password from the flow entirely. With no password to guess, spraying is ineffective against passkey-protected accounts.
Are Consumer-Facing Applications Targeted by Password Spraying?
Absolutely. High-traffic consumer apps are common targets because attackers can exploit credential reuse and weak password habits at scale. A customer identity and access management system benefits from the same passwordless and adaptive controls as workforce IAM.
Password spraying is not a clever exploit. It is a bet that you are still running password-first authentication and watching the wrong unit of analysis. Every control that treats the password as sacred, longer minimums, stricter rotation, tighter per-account lockouts, leaves the bet intact. The teams that take the password off the table are the ones the attack has nothing left to spray.
