What Is a Dictionary Attack? The Wordlist Is Not a Dictionary

You have probably met the term next to brute force, in a list of ways passwords get cracked. The label is the misleading part. A dictionary attack has almost nothing to do with dictionaries, and understanding what is actually in the list explains why some strong-looking passwords fall in seconds.

What the attack actually does

A dictionary attack guesses passwords from a prepared list of candidates rather than working through every possible combination of characters. The attacker takes a stolen hash, hashes each candidate in turn, and stops when two match.

That is the whole mechanism, and its power is entirely in the ordering. A brute-force attack is exhaustive and indifferent: it will find your password eventually, and against a long one, eventually means never in practice. A dictionary attack is selective. It spends every guess on something a human being plausibly chose, which means it either wins quickly or does not win at all.

So the two attacks are limited by different properties of your password. Brute force is beaten by length. A dictionary attack is beaten by unpredictability. Those are not the same thing, and a password can be strong against one and helpless against the other.

The wordlists are not dictionaries

Here is the part that gets left out. A modern attack list is not built from a language dictionary. It is built from passwords that real people have already used, harvested from previous breaches.

Every large leak becomes raw material. The entries are then ranked by how often each password appeared across real datasets, so the list is not alphabetical but ordered by likelihood, most common first. Public collections assembled this way are freely available, and they are used as routinely in legitimate security testing as they are in attacks.

This has a consequence worth sitting with. A password that appeared in any breach, anywhere, is not weakened only on that site. It has joined the list, and it is now near the front of the queue for every future attack against everyone. That is why "has this password been exposed" is a more useful question than "does this password look strong".

Rules: how one word becomes thousands of guesses

Cracking tools do not stop at the words in the list. They apply mangling rules, transformations applied to every entry to generate variants. The common ones are exactly what you would guess, and that is the problem:

• capitalise the first letter
• append a digit, a year, or 123
• add ! at the end
• substitute lookalike symbols for letters, a to @, e to 3, s to $
• reverse the word, or repeat it

Look at those again next to a website telling you your password needs an uppercase letter, a number and a special character. The rules exist because of that requirement. They are a description of how people satisfy it.

Password1! and P@ssw0rd are not clever. They are the first two rules applied to the single most common word in every list, and they are tried in the opening moments of an attack rather than at the end. A hybrid or combinator attack goes one step further and joins pairs of list entries, which pulls two-word passwords into range too.

Online and offline are different situations

The word "attack" covers two scenarios that behave nothing alike.

Online, against a live login form, the attacker is guessing through the website itself. Rate limiting, lockouts and detection make sustained guessing impractical, which is why attackers who want to work at scale switch to credential stuffing or password spraying instead: fewer guesses, spread across many accounts, to stay under the alarm threshold.

Offline, against a stolen hash database, none of those brakes exist. The attacker has the hashes on their own hardware and can guess as fast as the hash function allows. That last detail is what decides the outcome. Fast general-purpose hashes such as unsalted MD5 or SHA-1 can be tested at enormous rates on ordinary graphics hardware. Functions designed to be deliberately slow and memory-hard, such as bcrypt, scrypt or Argon2, collapse that rate by orders of magnitude and turn a weekend of cracking into something uneconomic.

You do not control which of those a website chose. You only find out afterwards, which is the argument for assuming the worst.

How to actually defend against it

The defence is not more complexity. It is less predictability, plus never reusing anything.

A password generated at random by software has no relationship to any wordlist and no rule that produces it, so the attack simply has nothing to try short of exhaustive brute force, where length takes over as the protection. That is the practical answer for almost every account, and it is why a password manager matters more than any rule about symbols.

If you want something you can actually type from memory, a passphrase works, but only under one condition: the words must be chosen at random by a machine. A phrase you composed yourself follows the patterns of your language and your habits. A phrase taken from a song lyric, a film line or a book is already in circulation as a single string. The randomness has to come from outside your head.

And uniqueness does the rest. If every account has its own password, a site that stores hashes badly and gets cracked costs you exactly one account instead of all of them.

Where it sits among the other attacks

• Brute force tries every combination, live. Defeated by length. See what a brute-force attack is.
• Dictionary attack tries a ranked list of likely passwords plus rule-based variants. Defeated by unpredictability.
• Rainbow table precomputes the hashing work and looks answers up. Defeated by salting. See what a rainbow table is.
• Credential stuffing replays real leaked pairs of username and password. Defeated by uniqueness. See what credential stuffing is.

They are usually described as four techniques. They are better read as four different bets about what your password looks like, and the only way to lose all four is to have a long, unique password that nothing and nobody predicted.