Replay Attack
A network attack where a valid data transmission is maliciously repeated or delayed. One-time passwords and session tokens are common defenses.
In a replay attack, an attacker captures a valid network transmission (such as an authentication request) and retransmits it later to gain unauthorized access. The attacker doesn’t need to understand or decrypt the captured data: simply replaying it can authenticate them.
Replay attacks target protocols that don’t include freshness checks. For example, if a login system accepts a static authentication token without verifying when it was generated, an intercepted token can be replayed indefinitely.
Defenses include timestamps in authentication messages, nonces (numbers used once), session tokens with short expiration, and TOTP codes that change every 30 seconds. These mechanisms ensure that captured credentials have a very limited window of validity.
Related reading
Stop sharing passwords in spreadsheets
TeamPassword stores, shares and rotates your team credentials, encrypted end to end.
Trusted by 900+ agencies and small teams worldwide