Brute-force attack
Also known as: brute force attack, brute-force, brute forcing
A brute-force attack is an attempt to break into an account, file, or encrypted data by systematically trying many possible passwords or keys until one works.
Attackers use software that can try millions or billions of guesses, especially against stolen password files. While brute force sounds unstoppable, long passwords or passphrases, account lockouts, and multi-factor authentication make it impractical.
Brute-force attack, explained at three levels
At home
A brute-force attack is like trying every combination on a padlock, one after another, until it clicks open. A computer does the same with passwords, but it can try millions of guesses a second against a stolen password file. A short password has few combinations, so it falls quickly, while each extra character multiplies the possibilities until guessing takes far too long to be worth it.
At work
A brute-force attack is an attempt to break into an account by automatically trying huge numbers of passwords until one works. Attackers aim it at email, remote desktop, and admin portals, especially where short passwords are allowed and there's no multi-factor authentication. Businesses defend by requiring long passwords, slowing or locking out repeated failed logins, and turning on MFA for every remote access point.
At home
Brute force is guessing at machine speed. Software tries every possible combination, or the most likely ones first, until one works. The number of possibilities grows enormously with each extra character, which is why length matters more than symbols. A random eight-character password has trillions of combinations, but a computer can test those quickly. A passphrase of five random words has so many more that guessing becomes impractical, and it is easier for you to remember.
At work
Online brute force targets a live login page, so lockouts, throttling and MFA slow it to a crawl. Offline brute force is far more dangerous: after a breach, attackers copy the password hashes and test guesses on their own graphics cards at billions per second against a fast hash. They use wordlists of leaked passwords with mutation rules, rather than pure combinations. Password spraying flips the method, trying one common password across many accounts to avoid lockouts, which is why breach screening helps.
At home
Cracking tools do not guess randomly; they start with leaked passwords and common substitutions. That is why something like 'P@ssw0rd1!' falls almost instantly, even though a strength meter might call it strong. The meter counts character types, while the cracker knows how people actually build passwords. In my view, the easiest fix is letting a password manager generate a long random password for each site, because then there is no human pattern to exploit.
At work
Defence differs by attack type. For online attacks, combine MFA, progressive throttling rather than hard lockouts, which attackers can abuse to lock out users, and monitoring for spraying across many accounts from distributed IPs. Remove internet-exposed RDP and legacy authentication protocols that skip MFA. For offline resistance, store passwords with a memory-hard algorithm such as Argon2id or a well-tuned bcrypt, enforce minimum length rather than complexity rules, and screen against breached-password lists, as NIST SP 800-63B recommends.
Real-world examples
At home
Thomas used a short password for an old gaming account. After a breach, attackers cracked it in minutes. He switched to long, random passwords stored in a password manager.
At work
Lena is IT lead for a Regina dental group. Logs showed thousands of guessing attempts against the office's remote desktop, so she shut it off from the internet and required VPN with MFA.
How it compares
| feature | Brute-force attack | Password spraying |
|---|---|---|
| Method | Tries many guesses on one account | Tries a few common passwords on many accounts |
| Detection | Easier, many failures per account | Harder, few failures per account |
| Lockouts | Effective | Often avoided by attackers |
| Best defence | Long passwords and lockouts | MFA and banned common passwords |
Brute force hammers one door. Spraying tries every door gently.
For analysts
I'd remove remote desktop from the internet and require MFA for all remote access. Those two steps defeat most brute-force attempts against small businesses.
History & origin
Trying every possible key is the oldest way to break a code. As computers grew faster, password cracking tools such as John the Ripper, first released in 1996, and Hashcat, released in 2009, made brute force and smarter 'dictionary' attacks easy, especially using graphics cards. Large password leaks gave attackers real-world examples to build better guess lists. Exposed remote desktop services became frequent brute-force targets, helping fuel ransomware. Security guidance shifted toward length: the US National Institute of Standards and Technology's password guidelines, revised in 2017 and again in 2025, recommended long passphrases and checking against breached passwords instead of forced complexity rules. In my view, the best defence against brute force is the most boring one: make passwords long.