Passwords are the keys to our digital lives — so attackers have many ways to steal or guess them. Knowing the methods shows you exactly how to defend.
What is it?
A password attack is any attempt to discover a password that is not yours. Because so many accounts are protected by a password alone, this is one of the most common attacks.
Select any component in the diagram to read what it does.
Text description of this diagram
Attackers have several ways to get past passwords — which is why strong, unique passwords and MFA matter.
Common methods
- Brute force — trying every possible combination until one works.
- Dictionary attack — trying common words and known popular passwords.
- Credential stuffing — reusing passwords leaked from other breaches.
- Guessing — using personal details like a pet’s name or birthday.
Why is it important?
Weak and reused passwords are behind a huge number of account takeovers. The methods above work best against short, simple, or repeated passwords — which tells us precisely how to make an account hard to break into.
How does it work? — your defence
- Use long passwords (length beats complexity).
- Use a different password for every account.
- Use a password manager to create and remember them.
- Turn on multi-factor authentication so a stolen password alone is not enough.
Credential stuffing only works because people reuse passwords. A unique password per site makes a leak from one site harmless to the others.
A real-world example
An attacker downloads a list of email-and-password pairs leaked from an old website breach, then tries them automatically on dozens of popular services (credential stuffing). Every account where the victim reused that password falls. The victims who used a unique password per site are untouched.
Check what you learned
What is credential stuffing, and why does it work?
Reusing passwords leaked from one breach to log in elsewhere — it works because people reuse the same password across sites.
Name two defences that make password attacks far harder.
Any two of: long unique passwords, a password manager, and multi-factor authentication.
Key takeaways
- Attackers brute-force, guess, and reuse leaked passwords.
- Reused and short passwords are the easiest to break.
- Long, unique passwords plus MFA defeat these attacks.