A brute-force attack is a cyberattack in which someone repeatedly tries different passwords, encryption keys, PINs, or login combinations until the correct one is found. Instead of exploiting a complicated technical flaw, the attacker relies on persistence, automation, and computing power.
You can think of it as trying every possible key until one opens the lock. A person could perform a few guesses manually, but modern brute-force attacks are usually automated. Specialized software can test large numbers of combinations much faster than a human.
Short passwords, reused credentials, exposed login pages, default administrator accounts, and systems without login limits are especially vulnerable.
How Does a Brute-Force Attack Work?
The attacker begins by choosing a target, such as:
- An email account
- A website login page
- A social media profile
- A wireless network
- A remote desktop service
- A VPN account
- An administrator panel
- An encrypted file
- A mobile device
- A cryptocurrency wallet
Automated software then submits possible credentials until it finds a valid combination or the system blocks further attempts.
The guesses may be completely random, taken from a dictionary, built from leaked passwords, or customized using information about the victim. Names, dates of birth, favorite teams, usernames, phone numbers, and predictable patterns can all make a password easier to guess.
The NIST glossary defines a brute-force password attack as attempting multiple numeric or alphanumeric password combinations to access a protected device or system.
Online and Offline Brute-Force Attacks
Brute-force attacks generally fall into two broad categories.
Online Brute-Force Attacks
An online attack sends login attempts directly to a website, application, VPN, or another authentication service.
The attacker is limited by:
- Internet speed
- Server response time
- Login rate limits
- Account lockout rules
- CAPTCHA challenges
- IP blocking
- Security monitoring
- Multi-factor authentication
Because every attempt reaches the service, online attacks can create visible warning signs in authentication logs.
Offline Brute-Force Attacks
An offline attack happens after an attacker obtains password hashes or an encrypted file. They can test guesses on their own hardware without sending each attempt to the original service.
This can be far more dangerous because the attacker may:
- Avoid account lockouts
- Avoid network monitoring
- Use specialized cracking hardware
- Distribute the work across multiple systems
- Try large numbers of guesses rapidly
The difficulty of offline cracking depends heavily on password length, randomness, and how securely the password was stored. Properly salted, slow password-hashing algorithms can make each guess more expensive.
Common Types of Brute-Force Attacks
Simple Brute-Force Attack
A simple brute-force attack systematically tests possible character combinations.
For example, an attacker trying to discover a four-digit PIN could begin with 0000 and continue through every possible combination until one works.
This method becomes increasingly impractical as passwords grow longer. Every additional character dramatically increases the number of possible combinations.
Dictionary Attack
A dictionary attack uses a prepared list of common passwords, words, phrases, and predictable patterns rather than testing every possible combination.
A dictionary list may contain:
- Common passwords
- Names and locations
- Keyboard patterns
- Popular phrases
- Sports teams
- Movie titles
- Frequently used number sequences
- Passwords exposed in earlier breaches
Although technically different from exhaustive brute force, dictionary attacks are commonly grouped with password-guessing attacks.
Hybrid Brute-Force Attack
A hybrid attack combines dictionary words with predictable modifications.
The attacker may test variations such as:
- Adding a year to a word
- Replacing “a” with “@”
- Replacing “s” with “$”
- Capitalizing the first letter
- Adding an exclamation mark
- Combining a name with a date
A password such as Summer2026! may look more complicated than summer, but it still follows a pattern commonly included in password-cracking rules.
Reverse Brute-Force Attack
In a reverse brute-force attack, the attacker starts with one known or common password and tests it against many usernames.
For example, the attacker might try the same weak password against thousands of email addresses. This approach can avoid repeatedly targeting one account and may be less likely to trigger basic account-lockout systems.
Password Spraying
Password spraying uses a small number of common passwords against many accounts. The attacker spaces out attempts to avoid locking individual accounts.
Instead of trying hundreds of passwords against one person, the attacker may try one password against every employee in an organization.
CISA has documented cyber actors using password spraying and other brute-force techniques to compromise accounts. Its guidance emphasizes stronger authentication, monitoring, and protection for internet-facing services. Read CISA’s advisory.
Credential Stuffing
Credential stuffing uses username-and-password combinations stolen from previous data breaches.
It is not a traditional brute-force attack because the attacker is not generating every possible combination. However, it relies on automated login attempts and succeeds when people reuse passwords across multiple services.
OWASP distinguishes the techniques this way:
- Brute force: testing many passwords against one account
- Password spraying: testing one or a few passwords against many accounts
- Credential stuffing: testing previously stolen username-and-password pairs
The defenses overlap, particularly unique passwords, multi-factor authentication, login monitoring, and rate limiting. OWASP’s credential-stuffing guidance provides a detailed comparison.
Rainbow Table Attack
A rainbow table contains precomputed values that can help attackers match password hashes to likely passwords.
Unique password salts make rainbow tables far less useful because the same password produces a different stored value for each account. Modern systems should combine unique salts with a strong password-hashing algorithm.
Distributed Brute-Force Attack
A distributed attack sends guesses from many devices or IP addresses.
Spreading the traffic can help attackers:
- Avoid simple IP-based blocking
- Increase the number of attempts
- Make the activity look less concentrated
- Target multiple accounts simultaneously
Some distributed attacks use compromised computers or botnets without the device owners’ knowledge.
What Accounts Are Most at Risk?
Any password-protected system can be targeted, but attackers frequently focus on:
- Email accounts
- WordPress administrator pages
- Social media accounts
- Online banking profiles
- Cloud storage accounts
- Remote Desktop Protocol services
- VPN gateways
- SSH servers
- Database accounts
- E-commerce dashboards
- Gaming accounts
- Cryptocurrency services
- Network routers
- Internet-connected cameras
Administrator and remote-access accounts are especially valuable because they may provide access to entire systems or business networks.
Why Do Brute-Force Attacks Still Work?
Brute-force attacks continue to succeed because many people and organizations use weak authentication practices.
Common problems include:
- Short passwords
- Reused passwords
- Default credentials
- Predictable password patterns
- Missing login limits
- Exposed remote-access services
- Outdated systems
- Disabled multi-factor authentication
- Poor password storage
- Unmonitored authentication logs
- Old accounts that were never disabled
Attackers do not always need to crack a highly complex password. They only need to find one weak account that provides useful access.
Warning Signs of a Brute-Force Attack
A user or administrator may notice:
- Repeated failed-login notifications
- Unexpected multi-factor authentication prompts
- Account-lockout messages
- Password-reset emails that were not requested
- Logins from unfamiliar devices or countries
- Successful access immediately after many failures
- Multiple accounts failing authentication at the same time
- An unusual rise in traffic to a login page
- Numerous attempts from one IP address
- Attempts distributed across many IP addresses
- Login activity outside normal working hours
- Attempts to access disabled or nonexistent accounts
- Unexplained changes to account settings
One failed login is normally harmless. A pattern of repeated or coordinated failures deserves investigation.
What Happens After a Brute-Force Attack Succeeds?
Once attackers gain access, they may:
- Read private emails and messages
- Steal personal or financial information
- Change the password and lock out the owner
- Disable security notifications
- Register their own authentication method
- Send phishing messages from the account
- Access connected applications
- Download confidential files
- Make unauthorized purchases
- Install malware
- Steal customer data
- Move deeper into a company network
- Encrypt systems with ransomware
- Sell the account to another criminal
A compromised email account is particularly serious because email is often used to reset passwords for other services.
How to Prevent Brute-Force Attacks
Create Long, Unique Passwords
Password length is one of the most important defenses against password guessing.
Current NIST guidance recommends passwords of at least 15 characters for password-only authentication. A memorable passphrase made from several unrelated words can be easier to use than a short, complicated password. NIST’s password guidance emphasizes length and explains why short passwords are vulnerable to guessing.
A strong password should be:
- Long
- Unique to one account
- Difficult to predict
- Unrelated to personal information
- Absent from known breached-password lists
Avoid predictable substitutions such as replacing “a” with “@” or adding “123” to a common word.
Use a Password Manager
A reputable password manager can create and store long, random passwords. This makes it practical to use a different password for every account.
Protect the password manager itself with:
- A long master passphrase
- Multi-factor authentication
- Updated software
- Secure recovery settings
Never reuse the master password elsewhere.
Enable Multi-Factor Authentication
Multi-factor authentication, or MFA, requires another form of verification in addition to the password.
Even if an attacker guesses or steals the password, they may still be unable to access the account.
Stronger options include:
- Passkeys
- Hardware security keys
- Authenticator applications
- Device-based approval
SMS codes are generally better than using a password alone, but they can be vulnerable to SIM-swapping, phishing, and interception.
CISA recommends MFA because it adds a critical security layer when a password is compromised. CISA’s MFA guidance explains its role in preventing unauthorized access.
Replace Default Credentials
Routers, cameras, software platforms, databases, and administrative tools may ship with default usernames and passwords.
Change these credentials before connecting the system to the internet. Disable or rename unnecessary default accounts where the product allows it.
Watch for Unexpected MFA Requests
Repeated approval notifications can indicate that an attacker already knows the password and is trying to make the user approve access.
Never accept an authentication request you did not initiate. Report repeated prompts and change the affected password from a trusted device.
Keep Software Updated
Security updates can repair flaws in login systems, password storage, session handling, and remote-access services.
Prioritize updates for:
- Operating systems
- Website platforms
- Authentication software
- VPN gateways
- Remote-access tools
- Routers and firewalls
- Content management systems
- Security plugins
- Mobile applications
How Website Owners Can Stop Brute-Force Attacks
Apply Login Rate Limiting
Rate limiting restricts how quickly authentication attempts can be submitted.
Limits should consider more than the IP address. Attackers may rotate IP addresses or distribute attempts across many devices.
Useful signals include:
- Account name
- IP address
- Device characteristics
- Location
- Attempt frequency
- Previously trusted sessions
- Known malicious infrastructure
NIST notes that limiting the permitted login-attempt rate can mitigate online password guessing. NIST’s digital identity guidance also identifies password length as a primary measure of password strength.
Use Progressive Delays
A system can gradually increase the waiting time after each failed attempt. For example, the first few errors may receive a normal response, while repeated failures trigger longer delays.
This slows automated guessing without immediately locking out someone who mistyped a password.
Design Account Lockouts Carefully
Account lockout can stop repeated attempts against one account, but overly aggressive lockouts can create another problem. An attacker could intentionally submit bad passwords to deny legitimate users access.
Safer approaches may include:
- Temporary lockouts
- Progressive delays
- Risk-based challenges
- User notifications
- Restricted account modes
- Self-service recovery
- Additional authentication requirements
Use CAPTCHA Selectively
A CAPTCHA can make large-scale automation more expensive, particularly after suspicious login behavior is detected.
It should not be the only defense. Some CAPTCHA systems can be bypassed, outsourced to human-solving services, or disruptive to users with accessibility needs.
Block Known Compromised Passwords
When users create or change passwords, compare the proposed password against a blocklist of commonly used and previously exposed credentials.
Do not require superficial complexity rules that encourage predictable patterns. Length, uniqueness, breached-password screening, and secure storage provide more meaningful protection.
Avoid Revealing Whether an Account Exists
Login and password-recovery pages should use consistent messages.
Instead of saying “Username not found,” use a response such as “The username or password is incorrect.” Similar response timing can also make account discovery more difficult.
Protect Every Authentication Endpoint
Attackers may avoid the main login page and target weaker alternatives, including:
- Mobile APIs
- Legacy authentication protocols
- Password-reset forms
- VPN services
- Administrative panels
- Single sign-on endpoints
- Remote-access systems
Every path that verifies credentials needs protection.
Store Passwords Securely
Websites should never store user passwords in plain text or reversible encryption.
Passwords should be processed with a modern password-hashing algorithm, such as:
- Argon2id
- scrypt
- bcrypt
- PBKDF2 when required in approved environments
Each password needs a unique cryptographic salt. OWASP recommends slow, memory-hard password-hashing methods because they make large-scale offline guessing more expensive. OWASP’s password-storage guidance explains the recommended approaches.
Monitor and Alert on Suspicious Activity
Authentication logs should help security teams identify:
- Large numbers of failures
- Password spraying across many users
- Attempts against dormant accounts
- Geographic anomalies
- Automated request patterns
- Unfamiliar devices
- Successful logins following repeated failures
- Attempts against privileged accounts
High-confidence activity should trigger alerts and an appropriate response.
What Should You Do If Your Account Is Under Attack?
Do Not Approve Unexpected Login Requests
Reject unfamiliar MFA prompts. If possible, select the option indicating that you did not initiate the request.
Change the Password
Use a trusted device and network to create a new, unique password. If the old password was reused, change it everywhere else it was used.
Start with your email account because it may control password recovery for other services.
Sign Out Other Sessions
Use the account’s security settings to sign out all devices and revoke unfamiliar sessions, application passwords, API tokens, and connected applications.
Changing a password does not always terminate existing sessions automatically.
Review Authentication Methods
Remove any unfamiliar:
- Phone numbers
- Recovery email addresses
- Passkeys
- Security keys
- Authenticator applications
- Trusted devices
- Backup codes
Create new recovery codes and store them securely.
Check for Unauthorized Changes
Review account activity, sent messages, forwarding rules, filters, purchases, downloads, and security settings.
For email accounts, attackers sometimes create hidden forwarding rules to continue receiving messages after the password changes.
Contact the Service Provider
Use the service’s official website or application to report the incident. Avoid links included in unexpected warning emails because the message itself could be phishing.
Notify Your Organization
Employees should report suspected brute-force activity to the IT or security team immediately. Early reporting can help protect other accounts targeted by the same campaign.
What Is the Difference Between Brute Force and Credential Stuffing?
A brute-force attack generates or selects many possible passwords and tests them against an account. Credential stuffing uses credentials already stolen from another service.
Credential stuffing succeeds mainly because of password reuse. A completely random, unique password prevents credentials exposed by another website from unlocking your account.
How Long Does It Take to Brute-Force a Password?
The time can range from seconds to longer than any practical timeframe.
It depends on:
- Password length
- Randomness
- Available character combinations
- Whether the attack is online or offline
- Hardware performance
- Password-hashing method
- Login rate limits
- Information already known about the password
Password-cracking charts can offer rough illustrations, but their estimates depend on assumptions that may not match a real system. The safest approach is to use long, unique passwords and MFA rather than relying on a particular estimated cracking time.
Can a Strong Password Be Brute-Forced?
In theory, any finite password could eventually be found by testing every possible combination. In practice, a sufficiently long and random password can require so much time and computing power that brute-force cracking becomes unrealistic.
A strong password can still be stolen through phishing, malware, a compromised service, or unsafe password storage. That is why password strength must be combined with MFA and secure account practices.
Does Changing a Password Stop a Brute-Force Attack?
Changing a weak or exposed password can protect the account, but it may not stop the attacker from continuing to submit guesses.
After changing it:
- Enable MFA
- Sign out existing sessions
- Remove unfamiliar recovery methods
- Review account activity
- Stop reusing the password
- Report continuing login attempts
Website owners should also investigate the source and pattern of the attack rather than relying only on a password reset.
