Common Password Attacks and How to Defend Against Them

By PasswordForge · August 10, 2026 · 6 min read

Passwords fail in a handful of well-understood ways. Understanding those ways is the first step to defending against them, because the defense for each attack is different. A password strong enough to resist brute force is useless if you reuse it across sites and one of those sites is breached. A unique password is useless if a keylogger captures it as you type. This article covers the five attack categories that account for almost all password compromises and the practical defense for each.

Brute Force Attacks

A brute force attack tries every possible password in the keyspace until it finds the right one. The attacker does not need to know anything about you — they just need time and compute. The defense is entropy. As we cover in our article on password entropy, every additional bit doubles the search space. A 40-bit password falls in minutes on a modern GPU; a 70-bit password takes tens of thousands of years.

Practical defense: use long, randomly generated passwords. A 16-character password drawn from all printable ASCII has roughly 105 bits of entropy — beyond the reach of any current brute force attack. Generate, do not invent.

Dictionary Attacks

A dictionary attack is a smarter brute force. Instead of trying every character combination, it tries a curated list of likely passwords: real words, common substitutions (a→@, o→0), known leaked passwords, and patterns like Qwerty123. The attacker starts with the most common passwords and works outward, which means the top 10,000 passwords cover a surprising fraction of real accounts.

The defense is randomness that is not based on words or patterns. A password generated uniformly at random from a large character set — or a passphrase of random words from a large list like the EFF long list — is not in any dictionary. Predictable modifications (capitalizing the first letter, appending a year) are in every dictionary attack's rules and add almost no real entropy.

Credential Stuffing

Credential stuffing exploits password reuse. Attackers take username and password pairs from one breach and try them against many other services automatically. Because a large fraction of people reuse passwords, the attack succeeds far more often than it should. It is the single most common cause of account takeover today.

The defense is a unique password for every account. That is impractical from memory alone, which is why a password manager is the correct tool for the long tail of accounts. For a full comparison of managers versus memorization and why reuse is the dominant risk, see our article on password managers versus memorization. Adding a second factor on critical accounts defeats credential stuffing even if the password leaks, because the attacker still cannot pass the second check.

Phishing

Phishing does not attack the password itself — it attacks the user. The attacker sends a message (email, SMS, fake support call) that impersonates a legitimate service and directs you to a fake login page that captures your credentials as you type them. The strength of your password is irrelevant if you hand it to the attacker yourself.

Defenses for phishing are layered:

• Verify the URL. Check the address bar before entering credentials. paypa1.com (with a numeral one) is not paypal.com.
• Use a password manager. Managers autofill credentials only on the legitimate domain they are stored for. If the manager does not offer to fill, the site is not the one you saved — a strong signal of phishing.
• Prefer hardware keys. A FIDO2 security key like a YubiKey is phishing-resistant by design: it checks the domain cryptographically and refuses to authenticate on a look-alike site.

Keyloggers

A keylogger is malware that records keystrokes and sends them to an attacker. If your device is compromised, any password you type can be captured regardless of its strength. Keyloggers arrive through malicious downloads, compromised installers, and browser extensions with excessive permissions.

Defenses:

• Keep your OS and browser updated. Most keylogger infections exploit known vulnerabilities that patches already fix.
• Use autofill, not typing. A password manager that autofills credentials denies the keylogger the keystrokes to record. The manager's vault encryption also protects the password at rest.
• Use a second factor. A TOTP code or hardware key is not typed from memory and is not captured by a keylogger the same way a static password is. A hardware key in particular is not a credential the keylogger can replay.

Defenses: The Layered Approach

No single defense covers every attack. The layered approach that does:

1. Strong, unique passwords. Generate long random passwords and store them in a password manager. This defeats brute force, dictionary, and credential stuffing attacks in one step.
2. A second factor on critical accounts. Prefer a hardware key (FIDO2) where supported; fall back to a TOTP app. SMS codes are weaker but better than nothing. A second factor defeats credential stuffing and keyloggers even when the password leaks.
3. A password manager with autofill. Autofill only on the correct domain defeats phishing. The encrypted vault protects credentials at rest on a compromised device.
4. Updated software and cautious installs. Patches remove the vulnerabilities keyloggers exploit; scrutinizing browser extensions and installers prevents infection in the first place.

For the few secrets you must memorize — your manager's master password, primary email, device login — use a randomly generated passphrase. See our comparison of passphrases versus passwords for why four or five random words beat a short complex string on both strength and recall.

Summary

Password attacks fall into five categories, and each has a different defense. Brute force is defeated by entropy — long, randomly generated passwords. Dictionary attacks are defeated by passwords not based on words or predictable patterns. Credential stuffing is defeated by unique passwords per account, which requires a password manager to be practical. Phishing is defeated by URL verification, autofill that checks the domain, and hardware keys that refuse to authenticate on look-alike sites. Keyloggers are defeated by keeping software updated, using autofill instead of typing, and a second factor the keylogger cannot replay. The common thread: generate, do not invent; use a manager; add a second factor on the accounts that matter. No single measure covers every attack, but the layered approach above does.