A dictionary attack is a password guessing method that tries common words, names, phrases, and known password patterns. It works because many people build passwords from familiar language.
Attackers do not have to guess randomly first. They can start with the passwords people are most likely to choose.
What attackers try first
Dictionary attacks often include common passwords, popular names, sports teams, keyboard patterns, seasons, years, and simple substitutions. A word with a number and symbol at the end may still be easy to test.
This is why passwords such as Summer2026!, Qwerty123, or CompanyName! are risky even though they may satisfy basic password rules.
- Common words and names.
- Keyboard patterns.
- Years and dates.
- Predictable symbol substitutions.
Why personal information is dangerous
A password based on your life is easier to guess than you may think. Public profiles, old breaches, business websites, social posts, and data broker records can reveal names, locations, birthdays, schools, employers, and interests.
Avoid anything connected to you, your family, your company, your pets, your hobbies, or your address.
How random passwords help
A random password does not resemble a word, name, phrase, or pattern. That makes dictionary guessing less useful because there is no obvious human habit to exploit.
Use at least 16 characters for most accounts and 20 or more for high-value accounts.
Passphrases must also be random
A passphrase can be strong, but only when the words are randomly chosen. A famous quote, lyric, joke, or sentence from your life is not the same as a random passphrase.
Use several unrelated random words and avoid meaningful personal phrases.
Practical examples
- Weak: a pet name plus a birth year.
- Weak: a company name plus an exclamation mark.
- Better: a 20-character generated password.
- Memorable: five random words generated as a passphrase.
Helpful related tools
FAQ
Are dictionary attacks only about real dictionary words?
No. Attack lists can include names, phrases, leaked passwords, keyboard patterns, and common substitutions.
Does adding a symbol stop dictionary attacks?
Not if the pattern is predictable. Randomness and length are much stronger than simple substitutions.
Can passphrases be vulnerable to dictionary attacks?
Yes, if they use predictable phrases. Random-word passphrases are much safer.
Conclusion
Dictionary attacks succeed when passwords are built from human habits. The best defense is to remove those habits from the password entirely.
Use random generation, unique passwords, and a trusted password manager.