Cybersecurity glossary
What is a Brute-Force Attack?
Learn what a brute-force attack is, how attackers systematically guess passwords, codes, and keys, how it differs from stuffing and spraying, and which defenses actually slow or stop it.
Definition
A brute-force attack is a trial-and-error method in which an attacker systematically tries many candidate secrets—such as passwords, PINs, one-time codes, or cryptographic keys—until the correct value is found or the attempt space is exhausted.
Why brute-force attacks matter
Attackers do not always need a software vulnerability. If a secret is short, predictable, or unprotected by attempt limits, they can simply try candidates until one succeeds.
A brute-force attack is that systematic guessing process. It targets passwords on login forms, four-digit PINs on phone portals, six-digit OTP fields, API keys with low entropy, and—offline—stolen password hashes. The method is old, but automation, botnets, and cheap compute keep it effective wherever defenses are thin.
For defenders, brute force is both an authentication problem and an availability problem. Aggressive lockouts can stop guessing while helping an attacker lock out legitimate users on purpose.
How a brute-force attack works
Select a target secret
Choose a password field, PIN, OTP, token, or hash that can be validated somehow.
Build a candidate space
Use full keyspace enumeration, dictionaries, masks, or hybrid rules based on likely patterns.
Submit or compute attempts
Online attacks call the service. Offline attacks hash or decrypt candidates locally at high speed.
Observe accept or reject
A successful login, different error, or matching hash confirms the candidate.
Optimize around controls
Rotate IPs, slow the rate, spray across accounts, or focus on weak policy islands.
Convert access into impact
Change recovery details, steal data, move laterally, or sell the working credential.
Online vs offline brute force
| Property | Online | Offline |
|---|---|---|
| Where guessing happens | Against a live authentication or verification endpoint | Against stolen hashes, vault exports, or ciphertext |
| Main limiter | Rate limits, lockouts, bot controls, latency, logging | Hash strength, salt, attacker GPU/CPU budget |
| Typical targets | Passwords, OTPs, PINs, backup codes | Password hashes, weakly encrypted secrets |
| Best primary defenses | Attempt budgets, MFA, anomaly detection | Modern salted hashing, secret rotation, vault hardening |
Brute force vs stuffing vs spraying
These terms are related but not interchangeable.
Brute force
Many guesses for a secret, often focused on one account or one OTP field, drawn from a generated or dictionary space.
Credential stuffing
Tests breached username/password pairs. Success depends on password reuse, not exhaustive search.
Password spraying
Tries a small set of common passwords across many accounts to stay under per-account thresholds.
Where brute force shows up
Password login
Classic /login guessing against weak or short passwords. Distributed bots keep per-IP volume low while still covering large dictionaries.
One-time codes
Six-digit SMS or app OTPs have only one million values. Without strict attempt limits and short validity windows, online brute force becomes realistic.
PIN and phone portals
Four-digit or six-digit PINs are attractive because the entire space is searchable when rate controls are absent.
Offline hash cracking
After a database breach, attackers crack unsalted MD5 or fast hashes at enormous speed. Slow memory-hard algorithms and unique salts change the economics.
Defenses that work
- Enforce strong secret quality for passwords and reject known-breached values where policy allows.
- Apply progressive delays, attempt budgets, and risk-based challenges on authentication and OTP endpoints.
- Prefer phishing-resistant MFA so a guessed password alone is insufficient.
- Hash stored passwords with a modern adaptive algorithm and unique per-password salts.
- Limit OTP and backup-code guesses aggressively; invalidate codes after few failures.
- Detect distributed guessing by account, device, ASN, and behavioral clusters—not only by single IP.
- Avoid user enumeration differences that help attackers prioritize valid usernames.
- Protect hash stores and secrets so offline brute force never gets a starting corpus.
CAPTCHA and bot management can raise cost for online guessing, but determined attackers adapt. Combine friction with identity-aware rate limits and monitoring rather than relying on a single challenge widget.
Operational warning signs
Look for authentication failure spikes on individual accounts, many accounts failing with the same password, OTP verification storms, and geographically distributed attempts that share tooling fingerprints. Successful logins immediately after long failure sequences deserve priority investigation.
The practical takeaway
A brute-force attack succeeds when secrets are weak enough and attempts are cheap enough. Online defenses must make live guessing slow, noisy, and incomplete. Offline defenses must make stolen hashes expensive to crack and quick to rotate.
If an endpoint can say “yes” or “no” to a candidate secret without a tight attempt budget, assume attackers will automate it.
Related security terms
Credential Stuffing
Uses known username/password pairs from breaches rather than inventing every guess.
Password Spraying
Tries a few common passwords across many accounts to avoid per-account lockouts.
Rate Limiting
Controls request velocity that online brute-force attacks depend on.
Broken Authentication
Broader authentication failures that make guessing and takeover easier.
Brute Force
Vulnerability-focused guidance on exploitation impact and application defenses.
Frequently asked questions
What is a brute-force attack in simple terms?
A brute-force attack keeps trying possible secrets until one works. For a login page, that usually means many password guesses against one or more accounts.
How is brute force different from credential stuffing?
Brute force invents or enumerates candidate secrets. Credential stuffing replays username and password pairs that already appeared in breaches. Stuffing needs valid leaked combinations; classic brute force needs enough attempts against the secret space.
What is the difference between online and offline brute force?
Online brute force hits a live service such as a login API and is limited by network controls. Offline brute force attacks stolen password hashes or encrypted material locally and is limited by attacker compute.
Can MFA stop brute-force attacks?
MFA blocks many account takeovers that succeed after password guessing, but OTP and backup-code endpoints can themselves be brute-forced if they lack rate limits and attempt budgets.
Do account lockouts prevent brute force?
Lockouts help against rapid guessing of one account, but they can enable denial of service and are less effective against password spraying across many usernames. Use lockouts carefully with monitoring and progressive delays.
Are long passwords immune to brute force?
Long, random passwords make exhaustive guessing impractical, especially when hashing is slow and salted. Short PINs, weak policies, and unsalted fast hashes remain realistic targets.
What should defenders monitor?
Watch repeated authentication failures, distributed low-and-slow guessing, spikes on OTP verification, and password-reset abuse tied to the same accounts or infrastructure.
References
Explore authoritative guidance and frameworks related to brute-force attack.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.