What is a dictionary attack?
A dictionary attack starts with a curated list of real words, names, and previously breached passwords. It then applies rules such as capitalising the first letter, appending a year, or swapping a for 4. This is much faster than brute force because human password choices are less random than they appear.
- Topic
- Attacks
- Reading time
- 1 min
- Reviewed
On this page
Why leet substitutions do not help
Every serious cracking tool applies substitution rules automatically. Turning 'password' into 'p@ssw0rd' adds under one bit of real strength, because the rule is in the toolkit's default configuration. The word is the weakness; disguising it changes almost nothing.
The rule that follows from this
If a human chose it, assume a dictionary attack may find it. Strength should come from random selection: either random characters or random words drawn by a machine from a list you did not curate.
Sources
These primary references support the terminology and current security guidance used in this definition.
