Brute Force Attack
A trial-and-error method where attackers systematically attempt every possible password or key combination until finding the correct one.
A brute force attack is a cryptanalytic method in which an attacker systematically tries every possible combination of characters to guess a password, encryption key, or other secret value. It is one of the most straightforward attack techniques: given enough time and computing power, a brute force approach will eventually find the correct answer. The method requires no prior knowledge of the target and works against any system that allows repeated authentication attempts without adequate controls.
There are several variations of brute force attacks. A simple brute force attack tries every possible character combination sequentially. A dictionary attack uses a precompiled list of common passwords and words. A hybrid attack combines dictionary words with character substitutions and numeric suffixes. Reverse brute force attacks try a known common password against many usernames. Rainbow table attacks use precomputed hash values to crack password hashes faster than real-time computation. GPU-accelerated cracking tools can test billions of password candidates per second against leaked hash databases.
While modern authentication systems can render online brute force attacks impractical through rate limiting and account lockouts, offline brute force — where an attacker has obtained a database of password hashes — remains a serious threat. Weak or short passwords can be cracked in seconds, even with hashing. Organizations must enforce strong password policies, use robust hashing algorithms with proper salting (such as bcrypt or Argon2), implement account lockout mechanisms, and require multi-factor authentication to mitigate brute force risks.
There are several variations of brute force attacks. A simple brute force attack tries every possible character combination sequentially. A dictionary attack uses a precompiled list of common passwords and words. A hybrid attack combines dictionary words with character substitutions and numeric suffixes. Reverse brute force attacks try a known common password against many usernames. Rainbow table attacks use precomputed hash values to crack password hashes faster than real-time computation. GPU-accelerated cracking tools can test billions of password candidates per second against leaked hash databases.
While modern authentication systems can render online brute force attacks impractical through rate limiting and account lockouts, offline brute force — where an attacker has obtained a database of password hashes — remains a serious threat. Weak or short passwords can be cracked in seconds, even with hashing. Organizations must enforce strong password policies, use robust hashing algorithms with proper salting (such as bcrypt or Argon2), implement account lockout mechanisms, and require multi-factor authentication to mitigate brute force risks.
Examples
- An automated tool tries every four-digit PIN combination to unlock a stolen smartphone.
- An attacker uses GPU clusters to crack password hashes from a stolen database, recovering weak passwords in minutes.
- A dictionary attack tries thousands of common passwords against a web application's login form.
Prevention
- Enforce strong password policies requiring length, complexity, and uniqueness.
- Implement progressive account lockouts and rate limiting after failed login attempts.
- Use modern password hashing algorithms like bcrypt, scrypt, or Argon2 with proper salting.
- Require multi-factor authentication to add a layer beyond password-based access.