# password-spraying

Source: https://startwithidentity.com/glossary/password-spraying/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

Trying a few common passwords across many accounts to avoid lockouts. Effective against weak password policies and accounts without MFA.

Spraying is designed to stay under lockout thresholds, so per-account controls do not see it and only population-level detection does: a small number of failures across a large number of accounts from a narrow set of sources. It remains effective because a predictable seasonal password still works somewhere in any organization above a few thousand people. Banning common and breached passwords does more than complexity rules.

See also: [credential stuffing](https://startwithidentity.com/glossary/credential-stuffing/), [account takeover](https://startwithidentity.com/glossary/account-takeover/), [MFA](https://startwithidentity.com/glossary/mfa/), [what is ITDR](https://startwithidentity.com/guides/fundamentals/what-is-itdr/)