Password spraying is a credential-guessing attack that tries a small number of likely passwords against many accounts, rather than making many guesses against one account. To reduce the risk, require strong multi-factor authentication, use unique hard-to-guess passwords, monitor authentication patterns across accounts, and review whether older login methods can be disabled.
How password spraying works
An attacker starts with a list of account names and tests a short list of common or otherwise likely passwords across them. Spacing attempts across accounts can help avoid account-specific lockout thresholds. The aim is to find even one valid username-and-password pair, then use whatever resources that account can reach. Microsoft describes this pattern in its password-spray guidance; MITRE classifies it as Password Spraying, technique T1110.003.
As an Amazon Associate I earn from qualifying purchases.
There is no single interval, tool, source address, or target that defines a spray. Attempts may be distributed or deliberately slow, so a threshold based only on repeated failures for one account can miss activity.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesSpraying is not credential stuffing
Password spraying guesses candidate passwords. Credential stuffing instead tests username-and-password pairs obtained from another source, such as previously exposed credentials. Both target account access, but the attacker is using different material.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to detect a possible spray
One failed login is not proof of an attack. Look for related signals across users, applications, and time, then investigate successful and interrupted sign-ins as well as failures. Microsoft’s detection guidance specifically warns that low-and-slow attempts may remain below lockout thresholds.
- Failures across many accounts: Check whether password-based failures connect through a source IP, device, application, user-agent, location, recurring time pattern, or other repeated attributes.
- Successes and MFA outcomes: Search for successful sign-ins from a suspected source and cases where the password appears to have been accepted but MFA was not completed. Microsoft recommends reviewing successful, interrupted, and unsuccessful sign-ins alongside MFA logs in its incident-response playbook.
- Unfamiliar access and follow-on activity: Investigate unexpected devices, operating systems, locations, or IPs; unprompted MFA requests; and activity on an account after the suspected attempts.
- Legacy authentication: Check for use of older protocols. Microsoft DART notes that these may provide a less detailed audit trail and may not support enforcing MFA requirements. See its recommendations on password sprays.
These clues need context: legitimate users can travel, change devices, or mistype passwords. Correlation across accounts and sign-in outcomes is more informative than treating any one attribute as conclusive.
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
How to reduce the risk
Require MFA, with phishing-resistant options where supported
MFA adds a check beyond the password, making access harder for an attacker who has guessed or obtained that password. CISA’s More than a Password guidance explains the value of MFA. Where the identity service, device, and account support them, phishing-resistant methods such as Windows Hello or a FIDO2 security key are options identified by Microsoft. Compatibility varies, and an authenticator is not a guarantee against every account attack; protect recovery routes and review sign-in activity too.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Use unique, difficult-to-guess passwords
Reusing a password gives a guessed or exposed password more reach. CISA’s #StopRansomware Guide recommends unique passwords of at least 15 characters in its password-hygiene guidance. That is CISA’s recommendation in that guide context, not a universal requirement attributed to every standard. A password manager can help people create and manage unique passwords.
Tune lockouts, throttling, and alerts together
Lockouts and throttling can impede repeated guesses, but overly strict lockout rules can be abused to disrupt access by triggering lockouts for legitimate users. MITRE documents this tradeoff in its Password Spraying reference. Monitor patterns across many accounts, and make sure alerting and account recovery can handle both suspicious activity and accidental lockouts.
Review older authentication methods
Inventory legacy authentication and determine whether applications or workflows still depend on it. Block older methods where feasible, but validate business impact and application dependencies before changing policies. Microsoft discusses these considerations in its investigation playbook and DART recommendations.
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
What to do if you suspect an attack
Use your organization’s incident-response and emergency-access procedures. The exact logs and controls depend on the identity provider and authentication architecture; Microsoft’s playbook provides provider-specific operational detail.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
- Set the investigation window and scope. Establish when the activity began and ended, note suspected source addresses, identify the authentication systems involved, and confirm which sign-in and MFA logs are available.
- Review the full sign-in picture. Correlate failures and successes across accounts and examine interrupted sign-ins and MFA outcomes. Determine whether a password was accepted even when the attacker did not complete MFA.
- Contain accounts with evidence of compromise. Reset credentials for suspected compromised accounts and contain access using approved emergency procedures. Consider related accounts that share credentials or access paths.
- Look for activity after sign-in. Review mailbox forwarding and rules, delegated access, cloud data accessed, and other changes or actions associated with the account.
- Assess suspicious infrastructure carefully. Contain suspicious sources where appropriate, but do not rely on blocking one address as a complete fix: attackers can change addresses, and shared VPN infrastructure can complicate attribution.
- Close the control gaps. Revisit MFA coverage, password practices, alerting and lockout settings, and the business need for legacy authentication in light of what the incident revealed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
