# Password Spraying

An attack that tries one common password against many different accounts before moving to the next, to avoid triggering lockouts.

**Password spraying[↗](/password-spraying)** is an attack technique in which an attacker tries one commonly used password, such as "Password123", against a large number of different accounts before moving on to try the next common password. This is the reverse of a typical brute-force attack, which tries many passwords against one account.

By spreading attempts across many accounts rather than hammering a single one, password spraying avoids triggering the account lockout policies designed to stop rapid-fire guessing on one login. Requiring strong, unique passwords and enabling multi-factor authentication[↗](/authentication) are the most effective defenses against it.