What is a brute force attack?
Definition
A brute force attack is when an attacker tries many passwords or codes, one after another, until one works. Automated tools can make thousands of guesses.
- Category
- Attacks
- Also called
- brute force password attack, password guessing
- Last updated
A brute force attack is guessing, done by software. The attacker picks an account, such as an email address, and a program tries passwords against it until the login succeeds. CISA's attack reference describes it as systematically guessing passwords using a repetitive or iterative mechanism, by someone who has no prior knowledge of the real password.
Variants you'll hear about
- Plain brute force tries every possible combination in order. It works on short passwords and fails on long ones, because each extra character multiplies the guesses needed.
- Dictionary attacks try likely passwords first: common words, names, keyboard patterns and the lists of passwords exposed in earlier breaches.
- Password spraying tries one popular password against many accounts, then a second password, and so on. CISA notes this is done to avoid locking accounts, since each account only sees a few failed attempts.
- Credential stuffing replays email and password pairs leaked from one site against other sites, betting that people reuse passwords.
Why it matters to you
You don't need to be a target. Automated guessing runs against any login page on the internet, and a short or reused password is the thing that makes it succeed. Once an attacker is in your email, they can reset passwords for your other accounts.
CISA's guidance is that length matters more than complexity or frequent changes. Its advisory AA25-212A states that passwords under 15 characters are more vulnerable to brute-force techniques, and its consumer advice is to use passwords that are long, random and unique for each account.
Brute force vs. related terms
- Phishing tricks you into giving the password away. Brute force guesses it.
- Password cracking usually means guessing against a stolen file of password hashes offline, rather than against a live login.
How to protect yourself
- 1
Use long, unique passwords
Make each one long and random, and never reuse them. A password manager remembers them so you don't have to.
- 2
Turn on two-step verification
CISA recommends multifactor authentication against password guessing. A guessed password alone then isn't enough to log in.
- 3
Avoid common passwords
Skip names, dates, keyboard patterns and anything that has appeared in a breach, since guessing tools try those first.
- 4
Check whether your passwords have leaked
If a password shows up in a breach, change it everywhere you used it. Serus monitors breach databases and the dark web and alerts you when your data appears, though it can't remove it from them.
- 5
Use login alerts
Turn on notifications for new sign-ins and lockouts on your email and bank accounts.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
How long does a brute force attack take?
It depends on how long and random the password is and on how the attacker gets to guess. Short, common passwords fall quickly. Long, random ones can take impractically long, which is why length is the main defense.
Does two-factor authentication stop brute force attacks?
It stops a correctly guessed password from being enough on its own, which is why CISA recommends it. It doesn't stop the guessing itself.
What is the difference between brute force and credential stuffing?
Brute force guesses passwords. Credential stuffing reuses real passwords leaked from another site, so it relies on password reuse instead of guessing.
Sources
Something wrong or out of date? Tell us and we'll re-check it.