What is a brute force attack?
Definition
A brute force attack is when an attacker tries many passwords or codes, one after another, until one works. Automated tools can make thousands of guesses.
Full glossary“A brute force attack is a cryptographic hacking method where attackers use automated software to systematically guess all possible combinations of passwords, PINs, or encryption keys until the correct one is found.”
- Category
- Attacks
- Also called
- brute force password attack, password guessing
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: cisa.gov, pages.nist.gov, ncsc.gov.uk
Last verified against the official page:
A brute force attack is guessing, done by software. The attacker picks an account, such as an email address, and a program tries passwords against it until the login succeeds. CISA's attack reference describes it as systematically guessing passwords using a repetitive or iterative mechanism, by someone who has no prior knowledge of the real password.
Variants you'll hear about
- Plain brute force tries every possible combination in order. It works on short passwords and fails on long ones, because each extra character multiplies the guesses needed.
- Dictionary attacks try likely passwords first: common words, names, keyboard patterns and the lists of passwords exposed in earlier breaches.
- Password spraying tries one popular password against many accounts, then a second password, and so on. CISA notes this is done to avoid locking accounts, since each account only sees a few failed attempts.
- Credential stuffing replays email and password pairs leaked from one site against other sites, betting that people reuse passwords.
Why it matters to you
You don't need to be a target. Automated guessing runs against any login page on the internet, and a short or reused password is the thing that makes it succeed. Once an attacker is in your email, they can reset passwords for your other accounts.
CISA's guidance is that length matters more than complexity or frequent changes. Its advisory AA25-212A states that passwords under 15 characters are more vulnerable to brute-force techniques, and its consumer advice is to use passwords that are long, random and unique for each account.
Brute force vs. related terms
- Phishing tricks you into giving the password away. Brute force guesses it.
- Password cracking usually means guessing against a stolen file of password hashes offline, rather than against a live login.
Example
An attacker points software at one account's login page and tries password after password until one works. NIST says online guessing like this can be slowed by limiting how many login attempts are allowed, and that short passwords are the ones that give way. The UK's NCSC lists it next to password spraying, which tries a few common passwords across many accounts instead.
How to protect yourself
- 1
Use long, unique passwords
Make each one long and random, and never reuse them. A password manager remembers them so you don't have to.
- 2
Turn on two-step verification
CISA recommends multifactor authentication against password guessing. A guessed password alone then isn't enough to log in.
- 3
Avoid common passwords
Skip names, dates, keyboard patterns and anything that has appeared in a breach, since guessing tools try those first.
- 4
Check whether your passwords have leaked
If a password shows up in a breach, change it everywhere you used it. Serus monitors breach databases and the dark web and alerts you when your data appears, though it can't remove it from them.
- 5
Use login alerts
Turn on notifications for new sign-ins and lockouts on your email and bank accounts.
See it in action
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
How long does a brute force attack take?
It depends on how long and random the password is and on how the attacker gets to guess. Short, common passwords fall quickly. Long, random ones can take impractically long, which is why length is the main defense.
Does two-factor authentication stop brute force attacks?
It stops a correctly guessed password from being enough on its own, which is why CISA recommends it. It doesn't stop the guessing itself.
What is the difference between brute force and credential stuffing?
Brute force guesses passwords. Credential stuffing reuses real passwords leaked from another site, so it relies on password reuse instead of guessing.
Sources
- | CISA · cisa.gov
- Brute Force Attacks Conducted by Cyber Actors · cisa.gov
- CISA and USCG Identify Areas for Cyber Hygiene Improvement After Conducting Proactive Threat Hunt at · cisa.gov
- Formulate Strong Passwords and PIN Codes · cisa.gov
- pages.nist.gov/800-63-4/sp800-63b/passwords/
- ncsc.gov.uk/collection/passwords/updating-your-approach
Something wrong or out of date? Tell us and we'll re-check it.
What changed
- The page now includes a worked example of a brute force attack and cites NIST and the UK's NCSC.