Definition
A Brute Force Attack is a trial-and-error method where attackers systematically try every possible combination of passwords or encryption keys until the correct one is found.
People Also Ask
Common questions about Brute Force Attack answered by our security experts.
Brute Force Attack in Practice
A brute force attack systematically tries credentials until one works. In its pure form it tries every combination; in practice it uses dictionaries, common passwords and patterns, because those succeed far faster than exhaustive search.
The important distinction is between online attacks, against a live service, and offline attacks against stolen password hashes. They have entirely different economics and entirely different defences.
Online attacks are rate-limited by you
Against a live login, every attempt requires a request and the service controls how many are possible. Rate limiting, progressive delay and lockout make exhaustive guessing impractical.
Which is why online attackers do not brute force in the classic sense. They spray a few common passwords across many accounts, or use credential stuffing — both of which stay under per-account thresholds.
Offline attacks are limited only by hardware
Once an attacker holds password hashes, guessing happens on their equipment at whatever rate they can afford. There is no rate limiting, no lockout and no logging. Modern graphics hardware and rented cloud capacity test enormous numbers of candidates.
This is why the hashing algorithm matters so much. Fast general purpose hashes fall quickly; algorithms designed to be slow and memory-intensive, with a unique salt per password, raise the cost by orders of magnitude.
Why length beats complexity
Cracking tools model human password construction. Substituting characters, appending a digit and capitalising the first letter are all anticipated patterns, so a short complex password falls well before its theoretical strength suggests.
Length increases the search space in a way that pattern modelling cannot shortcut. A long passphrase is both stronger and easier to remember, which is why current password guidance favours it over composition rules.
Where it still succeeds against services
Protocols and interfaces without throttling: older mail protocols, remote access services exposed to the internet, management interfaces, and interfaces where authentication was added without rate limiting.
Default and unchanged credentials on devices and appliances are the related case, where no guessing is needed at all. Those remain among the most reliably productive targets in any estate.
Detection, and what to watch
Failed authentication volume per source and per account. A distinctive pattern of a few attempts against very many accounts, which is spraying rather than brute forcing. And successful authentication following a burst of failures, which is the event that actually matters.
That last one is frequently not alerted on, even where the failure data is collected — which means the successful compromise passes unnoticed inside noise that was being recorded.
Short codes and interfaces are the softer targets
Six-digit verification codes have a small search space, so any interface that accepts unlimited attempts at one is brute-forceable in minutes. The same applies to short recovery codes, voucher numbers and numeric account identifiers.
Programmatic interfaces are frequently the place this is possible, because authentication was added without the rate limiting the web login has. Attempt limits on code verification, and throttling applied at the interface rather than only at the login page, are the specific fixes.
Where to start
Find the internet-facing services that accept a password with no second factor and no rate limiting. Those are where this attack still works, and they are usually older interfaces nobody has reviewed.
See account lockout. GuardsArm runs external penetration testing.
Related Terms
Credential Stuffing
Credential Stuffing is an automated attack that uses stolen username and password pairs from data breaches to gain unauthorized access to user accounts on other services, exploiting password reuse.
Password Policy
A Password Policy is a set of rules and guidelines that define requirements for creating, managing, and protecting passwords, including length, complexity, rotation, and storage standards.
Account Lockout
Account Lockout is a security mechanism that temporarily or permanently disables a user account after a specified number of consecutive failed authentication attempts to prevent brute force attacks.
Multi-Factor Authentication
Multi-Factor Authentication (MFA) is a security method that requires users to provide two or more verification factors to gain access to a resource. It combines something you know (password), something you have (token), and something you are (biometrics).
Related Reading
MFA Rollouts in Clinical Workflows: Avoiding Patient Care Delays
MFA fails in hospitals for workflow reasons, not technical ones. Shared workstations, gloved hands, no signal in the basement — and the factor…
Speak With an Expert
Book a free consultation to discuss brute force attack for your organization.
Related Services
Need Help With Brute Force Attack?
Our certified security professionals can help you implement the right brute force attack strategy for your organization. Get a free assessment today.
Book a Free Consultation