A password-guessing attack is repeated online login attempts using many password combinations, common passwords, or stolen credentials until one succeeds. It is a basic but effective form of account attack, especially when a service allows unlimited or poorly rate-limited authentication attempts. Variants include brute-force guessing, where many passwords are tried against one account, and password spraying, where a few common passwords are tested across many accounts to avoid lockouts.
This matters because remote access systems such as VPNs, web portals, and admin consoles are frequent targets. If multi-factor authentication is missing or weak, a single guessed password can open a trusted entry point into an internal network. Defenders look for bursts of failed logins, attempts from unusual locations, and sudden successful access after many failures. Common protections include MFA, account lockout or throttling, strong password policy, and monitoring for credential-stuffing patterns.