Brute-Force Attack

A brute-force attack attempts to gain access by systematically trying candidate passwords, PINs, or cryptographic keys until one succeeds. In its purest form the attacker enumerates every possible combination; in practice, most attacks are smarter — dictionary attacks work through lists of common passwords and leaked-credential wordlists, hybrid attacks append the predictable suffixes humans love ("Summer2026!"), and offline attacks crack stolen password-hash databases at billions of guesses per second on rented GPUs.

How it works

Online brute forcing hammers a login endpoint directly and is noisy, so attackers throttle and distribute it across botnets to stay under lockout thresholds. Its quieter cousins are password spraying, which tries a few common passwords against many accounts to avoid lockouts, and credential stuffing, which replays passwords already stolen from other sites. Offline cracking is where scale lives: once a breach yields hashed passwords, weakly hashed or short passwords fall in minutes, and every recovered password is then tested against corporate logins — because somewhere, someone reused it. Password attacks remain a background hum of the internet; Microsoft has reported observing thousands of password attacks per second against its identity systems.

How to defend against it

Length beats complexity: a long unique passphrase resists guessing far better than a short "complex" one, and a password manager makes uniqueness practical at scale. On the infrastructure side, enforce rate limiting and smart lockouts, monitor for spray patterns across accounts, hash stored passwords with a modern memory-hard algorithm, and screen new passwords against known-breached lists. Most importantly, stop letting a guessed password be enough: multi-factor authentication turns a cracked credential into a dead end, and phishing-resistant passkeys remove the guessable secret entirely — there is no password to brute-force. Our passkeys and FIDO2 migration guide covers how organizations are making that shift. Training matters at the margin too: employees who understand why "Password1!" variants fail will stop feeding the wordlists that make these attacks cheap.