Glossary
Dictionary attack
A dictionary attack tests words from a predefined list against a hash instead of every possible combination — faster because real passwords are not random.
A dictionary attack tries candidate passwords drawn from a predefined list — a "dictionary" of real words, names, leaked passwords or common patterns — rather than generating every possible combination. It exploits the fact that people rarely choose truly random passwords, so a well-chosen list catches a large share of real-world credentials in a fraction of the time a full brute-force attack would take.
In practice the "dictionary" is usually a wordlist such as rockyou.txt, often combined with rules that mutate each entry — appending digits, swapping letters for symbols, changing case — so one dictionary word yields many realistic variants. This hybrid of list plus mutation is what most people mean when they say "dictionary attack" today, rather than a literal unmutated word list.
A dictionary attack trades completeness for speed: it will never find a password that is not on the list or reachable through its rules, but against the keyspace a mask attack or brute force would otherwise have to cover, it concentrates all the guessing on the passwords people actually pick — see the wordlist and rules setup that actually cracks passwords for how to build one.