Password Spraying vs Brute Force: What Is the Difference?

Brute force and password spraying are two ways attackers try to break into accounts. They work differently, and each is stopped by different defences.

Brute force

Many guesses against a single account. Lockout rules after a few failed attempts are the usual defence.

Password spraying

One or a few common passwords tried across many accounts. Because each account sees only a few attempts, it avoids lockouts.

What passwords are used

Sprays use very common choices like seasonal words or simple patterns. Any account with an easy password is vulnerable.

Defences

• Unique, uncommon passwords.
• Two-factor authentication.
• Monitoring for many failed logins from one source.
• Blocking known weak passwords at signup.