A brute force attack is a trial-and-error method where an attacker systematically tries every possible combination of credentials until finding one that works.
TL;DR In a brute force attack, an attacker submits large numbers of username-password combinations to an authentication endpoint, hoping one eventually succeeds. Pure brute force tries every possible combination. Dictionary attacks try lists of common passwords. Credential stuffing tries username-password pairs from previous data breaches. Modern brute force is entirely automated — bots can test thousands of combinations per second. The primary defenses are rate limiting, account lockout, MFA, and bot detection.
What is a brute force attack?
A brute force attack is a cryptanalytic technique that discovers a secret (password, encryption key, API key, or session token) by exhaustive search — systematically trying every possible value until the correct one is found.
In web application security, brute force most commonly targets login forms: the attacker submits many different password combinations for a target username until authentication succeeds.
The word “brute” reflects the approach — no intelligence or cleverness, just raw computational force. A 6-character lowercase password has 308 million combinations. A modern computer testing 1 billion combinations per second would crack it in under a second. An 8-character mixed-case alphanumeric password has 218 trillion combinations — harder, but not impossible offline.
Types of brute force attacks
Pure brute force
Tries every possible combination of characters in order: a, b, c, …, aa, ab, …, zzzzzz. Exhaustive and slow — practical only for short or simple targets, or offline against exposed password hashes.
Dictionary attack
Instead of every possible combination, tries a list of likely passwords — common words, popular passwords (password, 123456, qwerty), names, and their common variations (P@ssw0rd, password1). Dictionary attacks are far more efficient because most users choose predictable passwords.
Credential stuffing
Uses username-password pairs from previous data breaches. If a user’s credentials were leaked from one service and they reused the same password elsewhere, credential stuffing will find those reused credentials. Credential stuffing is not technically a brute force attack — it uses known credentials, not random guessing — but it exploits the same authentication endpoints.
Password spraying
Instead of trying many passwords against one account (which triggers lockouts), password spraying tries one or a few common passwords against many accounts. For example: try Summer2026! against 10,000 different usernames. This avoids per-account lockout thresholds while still compromising accounts that use common passwords.
Reverse brute force
Starts with a known common password and tries it against many usernames — the inverse of a traditional attack. Similar to password spraying.
What attackers target
| Target | Why |
|---|---|
| Login forms | Direct account access |
| Admin panels | High-value access, often weak passwords |
| SSH and RDP | Server access, often exposed to internet |
| API authentication endpoints | Often have weaker rate limiting than web forms |
| Password reset flows | May have fewer protections than login |
| Wi-Fi WPA2 handshakes | Can be captured and cracked offline |
| Encrypted files and archives | No lockout mechanism offline |
How modern brute force works
Manual brute force is impractical — the volume required makes it entirely automated. Modern brute force uses:
- Botnets — thousands of infected devices, each sending a few requests to avoid per-IP rate limits
- Residential proxies — legitimate-looking IP addresses that bypass IP-based blocks
- Distributed attacks — spreading requests across many IPs, devices, and timeframes
- Credential lists — using known breach data instead of random guessing
Automated tools (Hydra, Medusa, Burp Suite Intruder) can test hundreds of thousands of combinations per hour against web login forms, operating slowly enough to evade naive rate limiting while still being effective at scale.
How to prevent brute force attacks
Rate limiting
Limit the number of login attempts per unit of time — per IP, per username, or per device fingerprint. A limit of 5 failed attempts per minute per IP makes automated brute force 1,000x slower. Combine per-IP and per-account limits to catch both targeted and distributed attacks.
Account lockout
Temporarily lock an account after a defined number of failed attempts (e.g., 10 failures → 30-minute lockout). This stops targeted attacks on specific accounts but can be abused by attackers to lock out legitimate users (denial of service). Progressive delays (exponential backoff) are often preferable.
Multi-factor authentication (MFA)
MFA requires a second factor — TOTP code, hardware key, push notification — in addition to the password. Even if an attacker guesses the correct password, they cannot authenticate without the second factor. MFA is the single most effective defense against brute force and credential stuffing — it reduces account compromise risk by over 99%.
CAPTCHA
Requiring a CAPTCHA challenge after failed attempts forces human interaction, blocking automated bots. CAPTCHA adds friction for users — use it as a secondary defense after repeated failures rather than on every login attempt.
Bot detection and management
Advanced bot detection identifies automated brute force based on behavioral signals: request timing patterns, mouse movement, browser fingerprinting, IP reputation, and session behavior. Bot management solutions block automated attacks before they reach the authentication layer — even when they use rotating IPs and distributed infrastructure.
Strong password policies
Enforce minimum length (12+ characters), complexity, and check passwords against known breach lists (Have I Been Pwned API). Passwords that appear in breach databases are far more likely to be tried in brute force and credential stuffing attacks.
Monitoring and alerting
Alert on: high failed login rates per IP, per username, or globally; unusual geographic login patterns; login attempts at unusual hours. Failed logins at scale are almost always automated attacks.
Brute force vs credential stuffing vs password spraying
| Attack | Passwords tried | Accounts targeted | Lockout risk |
|---|---|---|---|
| Pure brute force | Every combination | One specific account | High (many attempts per account) |
| Dictionary attack | Common password list | One or more accounts | Medium |
| Password spraying | One or few passwords | Many accounts | Low (few attempts per account) |
| Credential stuffing | Known breach pairs | Many accounts | Low (one attempt per credential pair) |
Frequently asked questions
What is a brute force attack in simple terms? A brute force attack is when an attacker tries many different passwords — sometimes every possible combination — until finding the one that unlocks an account. It’s like trying every key on a keyring until one opens the door. Modern brute force is automated, with software testing thousands of combinations per second.
How long does a brute force attack take? It depends on the password length, complexity, and whether the attack is online (against a live login form with rate limiting) or offline (against a captured password hash). An 8-character password with mixed case and numbers has 218 trillion combinations — an offline attack on a weak hash could crack it in hours; a properly rate-limited online system could make it take centuries.
What is the difference between brute force and credential stuffing? Brute force tries many possible passwords, usually random or from a wordlist. Credential stuffing uses real username-password pairs stolen from previous data breaches. Credential stuffing is much more efficient when it works, because it uses credentials people actually chose — not random guesses.
Does account lockout stop brute force? Account lockout stops targeted brute force against specific accounts by blocking after a defined number of failures. It doesn’t stop password spraying (which tries few passwords across many accounts) or credential stuffing (which uses correct passwords). It can also be abused to lock out legitimate users. Rate limiting combined with bot detection is more effective.
Does MFA stop brute force? Yes — MFA is the most effective defense. Even if an attacker correctly guesses or steals a password, they cannot authenticate without the second factor (TOTP code, hardware key, push notification). MFA makes brute force attacks largely irrelevant for accounts that use it.
What is password spraying? Password spraying is a brute force variant that tries one or a few common passwords (like Spring2026!) against many different user accounts. It avoids per-account lockout thresholds because each account only receives one or two failed attempts. It’s particularly effective against organizations where many users share the same weak password patterns.
Is brute force illegal? Yes. Unauthorized brute force attacks against systems you don’t own are illegal in most jurisdictions — including under the Computer Fraud and Abuse Act (US), the Computer Misuse Act (UK), and similar laws globally. Legitimate security testing (penetration testing) is performed under explicit written authorization.
How do bots make brute force more dangerous? Automated bots can test thousands to millions of credential combinations per hour, far exceeding what any human could attempt manually. Modern bot networks use residential IP addresses and randomize request timing to evade naive rate limiting and IP blocking. Bot management platforms detect and block these automated attacks based on behavioral signals rather than just IP reputation.