Dictionary Attack

A Dictionary Attack is a Brute Force Attack which prioritizes words in a dictionary over random combinations.

A Brute Force attack will guess all possibilities in a key space. But it does not have to try them in order. The first guess could start at “a” or start at “z”. Nor do guesses need to be sequential. So which order should they choose?

Users prefer to choose passwords which use common words that are easy for them to remember. A password like “redapple” is more user friendly than “5#fB$2eP”. Attackers know that this is human nature so they try guessing dictionary words first when performing Brute Force Attacks. This does not change the total time required to search the full key space, but in practice it can greatly reduce the actual time required to find the correct password.

A cracking “dictionary” is not just words from a dictionary like Webster’s. It includes common passwords like “password1234”, “qwerty”, and “letmein”. It includes inventive spellings and letter substitutions like “L33T5P34K” and “passw0rd”. (Using numbers and symbols to replace letters is common and is referred to as “Leet-speak”). Password crackers know to include substitutions in their dictionaries.

Most importantly, a cracking dictionary includes millions of passwords which have been discovered from previous hacks, usually when a large database of credentials is stolen. These could include a password which the same user provided for access to another site, or it could just include passwords which many users share based on common personal or cultural tastes. For example, the password “ncc1701” sometimes shows up in these databases and may seem random at first. But to the many fans of Star Trek, it is the registry numbers for the USS Enterprise.

Preventions

Because a dictionary attack exploits the fact that users pick memorable, previously-seen, or human-patterned passwords, the best defenses combine constraints on the passwords accepted with rate-limiting and hashing choices that make each guess expensive.

Screen submitted passwords against a breach corpus. The OWASP Authentication Cheat Sheet recommends blocking “common and previously breached passwords” at registration and password change — the same dictionaries attackers use are freely available for defenders. The Have I Been Pwned “Pwned Passwords” k-anonymity API lets you check submitted passwords against hundreds of millions of known-breached values without sending the full password over the wire.
Require length, not composition. Per NIST SP 800-63B Rev. 4, require a minimum of 15 characters when a password is the only authenticator, accept up to at least 64 characters, and do not impose character-composition rules (mixed case, digits, symbols) — those push users toward the predictable mutations attackers already have in their dictionaries. See Strong Passwords for the full guidance.
Hash passwords with a slow, memory-hard algorithm. The OWASP Password Storage Cheat Sheet recommends Argon2id (minimum 19 MiB memory, 2 iterations, 1 degree of parallelism); scrypt or bcrypt (work factor ≥10) are acceptable fallbacks. This does not stop online dictionary attacks, but it makes offline cracking of a stolen hash database orders of magnitude more expensive per guess. See Password Hashing.
Throttle failed attempts. Use login throttling with exponential back-off or an account-lockout threshold so an attacker cannot try more than a handful of dictionary entries per account per hour through the live login flow.
Require multi-factor authentication. OWASP notes that MFA “would have stopped 99.9% of account compromises.” Even if a dictionary attack guesses a user’s password, the second factor blocks the login. See Multi-Factor Authentication.