What is a dictionary attack?
Definition
A dictionary attack is a way of guessing a password by trying a long list of likely words and common passwords instead of every possible combination. It is a faster, more targeted cousin of a brute force attack.
- Category
- Attacks
- Also called
- password dictionary attack, wordlist attack
- Last updated
Most people pick passwords from a small pool: real words, names, keyboard patterns and small tweaks like a number on the end. A dictionary attack uses that habit. The attacker feeds a list of likely passwords, often with common variations added, into a login form or a stolen file of password data, and sees which one works.
NIST describes a brute force password attack as trying multiple combinations of numeric and alphanumeric passwords to get into a device. A dictionary attack follows the same idea but starts with the combinations people are most likely to have chosen, so it usually gets to a weak password much sooner than trying everything.
Online and offline
There are two ways to run one. In an online attack, the attacker submits guesses to the real login page, which is slow and easy for a site to limit or lock. In an offline attack, the attacker has already stolen password data from a breached service and can test guesses on their own computer, with no lockouts and no one watching. That second case is why a leaked password database is dangerous even when the passwords were scrambled.
A concrete example
Someone uses "Summer2024!" for a forum account. The forum is breached and the password data leaks. A list of common passwords and their usual variations includes that exact pattern, so it falls quickly. If the same password also opens their email, the attacker now has a way into much more.
Dictionary attack vs. related terms
- Brute force attack tries every combination. It is thorough but slow. A dictionary attack trades completeness for speed.
- Credential stuffing doesn't guess at all. It replays real email and password pairs from earlier breaches on other sites.
What protects you is the same in each case: a password that appears on no list because it was never chosen by a person.
How to protect yourself
- 1
Use a long, random password for every account
A password manager generates passwords that don't appear in any word list and remembers them for you. Length matters more than clever substitutions like swapping an "a" for "@".
- 2
Never reuse a password
Once one site leaks, attackers try the same password elsewhere. Unique passwords keep one breach from becoming five.
- 3
Turn on two-factor authentication
Even a guessed password isn't enough if the login also needs a code or security key. Start with your email, bank and phone account.
- 4
Check whether your email has shown up in a breach
If it has, change that password now and anywhere you reused it. Serus monitors breach databases and the dark web for your email and passwords and alerts you when they appear, so you know which ones to change.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is a dictionary attack the same as brute force?
No. Brute force tries every possible combination. A dictionary attack tries likely passwords first, so it is quicker against weak passwords and useless against truly random ones.
Can a dictionary attack crack a long password?
Only if the password is on the list. A long phrase made of common words in a predictable order can be, while a long random string almost never is.
How do I know if my password is vulnerable?
If you chose it yourself from a word, a name, a date or a keyboard pattern, assume it is. A password manager's generated passwords are the safer choice.
Sources
Something wrong or out of date? Tell us and we'll re-check it.