A dictionary attack is a method used by hackers to break into password-protected accounts by systematically entering every word in a predefined list (a “dictionary“) until the correct password is found.

Unlike a brute-force attack, which tries every possible combination of characters (aaaa, aaab, aaac…), a dictionary attack is more strategic. It relies on the fact that many people use common words, names, or simple phrases for their passwords.

How Dictionary Attack Works?

• Preparation: The attacker acquires a “wordlist“. These lists contain hundreds of thousands of entries, including standard dictionary words, common passwords from past data breaches (like “password123“), and localized terms.
• Automated Entry: A script or software (like John the Ripper or Hashcat) automatically inputs these words into a login field or compares them against a stolen database of password “hashes“.

• Variations: Advanced attacks use “rules” to try common variations, such as:
  • Appends/Prepends: password becomes password2024!
  • Leet Speak: security becomes 53cur1ty.
  • Capitalization: london becomes London.

Why It is Effective?

Hackers don’t just use English dictionaries. They use specific lists tailored to the victim’s language, interests, or even common keyboard patterns (like qwerty). Because these attacks ignore “nonsense” combinations (like xR9!z), they are much faster than brute-force attacks at cracking human-created passwords.

How to Defend Against It?

• Use Passphrases: Instead of one word, use a string of random words (e.g., purple-stapler-mountain-coffee). These are rarely in dictionaries.
• Account Lockouts: Systems that lock an account after 3–5 failed attempts stop dictionary attacks in their tracks.

• Multi-Factor Authentication (MFA): Even if the attacker guesses the password, they cannot enter without the secondary code from your phone or email.
• Salting Hashes: For developers, “salting” passwords (adding random data to the password before hashing it) prevents attackers from using pre-computed dictionary lists to crack a database.