Brute force gets the headlines, but almost nobody's password actually dies to it. Searching every 10-character combination means quintillions of guesses; even a fast rig grinds at that for years. So attackers don't search the space of possible passwords - They search the space of passwords people pick, which is thousands of times smaller and dense with hits. That's a dictionary attack: guessing from curated lists of likely candidates, transformed by rules that mimic human decorating habits. It's the workhorse of real-world password cracking, and its existence rewrites the definition of a strong password: not "complex," not even "long," but absent from the candidate list.
From Webster's to breach corpora
The name misleads. Early dictionary attacks in the 1970s and 80s really did use linguistic dictionaries - And worked alarmingly well, famously helping the 1988 Morris worm spread using a list of just a few hundred common passwords. The modern version uses something far deadlier: other people's actual passwords.
Every major breach of the past two decades has contributed to public corpora. The 2009 RockYou breach alone exposed 32 million real passwords in plaintext, and rockyou.txt remains a canonical starter wordlist; its descendants and aggregate collections now bundle billions of entries from thousands of breaches. Have I Been Pwned's Pwned Passwords corpus catalogs over 800 million unique compromised passwords - Each one a proven human choice, each one guess number few-thousand-or-better in a competent attack.
This is why "it's not in the dictionary" is no defense. chelsea1905, metallica, and iloveyou2 aren't in Webster's - They're in rockyou.txt thousands of times. The candidate list isn't a lexicon; it's a census of human password behavior. Browse the most common passwords and you're reading the top of every attacker's list.
Mangling rules: your clever trick, automated
Raw wordlists only catch exact repeats. The real power comes from rules - Small transformation programs applied to every word in the list. A cracking tool like hashcat takes dragon and a standard ruleset and emits Dragon, dragon1, dragon123, dr@gon, DRAGON!, dragon2026, nogard, dragondragon - Hundreds of variants per word, generated at billions of candidates per second on GPU hardware.
Rule sets aren't guesses about human behavior; they're trained on it. Researchers and crackers mine breach corpora for the statistical shape of our decorations: capitalize the first letter, append digits, append the current year, suffix an exclamation point, substitute a→@, e→3, o→0. Every "trick" you've ever been proud of is a one-line rule that has already run against a billion hashes. Public rulesets like best64 and dive encode thousands of these patterns, ranked by yield.
If you invented your password by taking a word and doing something to it, a rule exists that does the same thing to the same word. You didn't create entropy - You recreated a rule.
The practical consequence: a password's resistance isn't about its final appearance but about its generation process. K9#mQ2$v and P@ssw0rd both mix cases, digits, and symbols. One was random draws; the other is a top-ten rule hit. Composition rules can't tell them apart - Which is exactly why NIST SP 800-63B moved away from composition requirements and toward checking candidates against known-breached lists instead.
Anatomy of an attack
Dictionary attacks come in two operating modes, with wildly different guess budgets:
Online, against a live login page: the attacker scripts login attempts directly. Rate limiting and lockouts cap the pace, so only the very top of the wordlist gets tried - But as the most-common-passwords data shows, the top of the list is depressingly productive. (A stealthier cousin tries a few passwords against many accounts to duck lockouts.)
Offline, against a stolen database of hashed passwords: no limits at all. The attacker hashes each candidate and compares. Speed depends on the site's hashing choice - Billions of guesses per second against MD5 or SHA-1, thousands against bcrypt or Argon2. You can see the mechanics of hashing firsthand with a SHA-256 generator: type a candidate, get its hash - That's the comparison a cracking rig performs, just done a few billion times faster. The full attack taxonomy, from brute force through precomputed tables, is mapped in how hackers crack passwords.
Typical offline priority order:
- Straight wordlist - Billions of known passwords, tried verbatim.
- Wordlist + rules - Each word mangled hundreds of ways.
- Combinator - Word pairs welded together (
purpletiger). - Masks - Targeted brute force of human formats, like
Uppercase + 5 lowercase + 2 digits, which covers a huge share of "complex" passwords with a comparatively tiny search. - True brute force - Last resort, short lengths only.
Most human passwords fall in stages 1–2, within minutes.
What survives, what doesn't
| Password | Looks | Real resistance |
|---|---|---|
sunshine |
Weak | Wordlist, instant |
Sunshine2026! |
"Strong" per most meters | Wordlist + basic rules, seconds-to-minutes |
S6nsh!ne_88 |
Strong | Rules + masks, hours-ish - Dressed-up word |
correcthorse |
Modest | Combinator stage - Two words is not enough |
mQ2$vK9#xL4p |
Strong | Absent from all lists; full brute force only - Effectively unreachable |
glove-baron-tulip-onyx-crane-fog |
Odd but plain | Six random words ≈ 77 bits - Unreachable even with word-level attacks |
The last row deserves its footnote: attackers do run word-level dictionary attacks against passphrases, treating each word as a "character" from a 7,776-word alphabet. Randomly chosen words defeat this by arithmetic - 7,776⁶ is about 2×10²³ combinations - But humanly chosen phrases collapse, because lyrics, quotes, and grammatical sentences occupy a tiny, heavily indexed corner of phrase space. The distinction between dice-picked and brain-picked words is the entire subject of what is a passphrase.
Getting off the candidate list
The defense follows directly from the attack's logic: be a candidate the generator never emits.
- Generate, don't invent. A password generator drawing from a cryptographically secure source produces strings that exist in no corpus and match no rule's output distribution. Sixteen-plus characters puts even mask attacks out of reach; the entropy arithmetic is in password entropy explained.
- For memorized passwords, random words. Six or more, chosen by a passphrase generator - Never by you.
- Never reuse. Dictionary attacks are how a mediocre site's leaked database gets cracked; reuse is how those cracked passwords then open your good accounts.
- Check the corpus. Have I Been Pwned's Pwned Passwords lets you (and sites, via API) test whether a password already circulates in breach data. If it's there, it's in wordlists; retire it.
FAQ
What's the difference between a dictionary attack and brute force?
Brute force tries every possible combination in a space - Exhaustive but astronomically slow beyond short lengths. A dictionary attack tries only plausible candidates: known passwords, words, and their rule-mangled variants. It trades completeness for speed and wins against nearly all human-chosen passwords; brute force is the fallback for the tiny random remainder.
Does adding numbers and symbols to a word defeat a dictionary attack?
No - Decoration is precisely what mangling rules automate. Appending digits, swapping a for @, capitalizing the first letter: these are the most common transformations in breach data, so they're the first rules every cracker runs. Decorated words fall minutes after bare words do.
Are long words safer than short ones?
Barely. A wordlist entry is one guess regardless of length - floccinaucinihilipilification costs the attacker the same single hash as cat. Length only creates strength when it multiplies independent random choices: random characters, or multiple randomly selected words. One long word is one point in a small search space.
How do sites defend against dictionary attacks?
Online: rate limiting, lockouts, bot detection, and 2FA. At registration, NIST-aligned sites screen new passwords against breached-password lists, refusing candidates that already circulate. Offline, the backstop is slow, salted hashing (bcrypt, scrypt, Argon2), which cuts guessing from billions per second to thousands and makes even wordlist attacks expensive.
Is a password made of two words in another language safe?
Safer than English, weaker than you'd hope. Cracking wordlists cover major languages, transliterations, and combined-pair attacks, and attackers targeting a region load its dictionaries first. Foreign words are still words - Points in a searchable list. Random selection, not linguistic obscurity, is what removes you from the list.