What Is a Brute Force Attack?

A brute force attack is a cyberattack that systematically tries many combinations of passwords or encryption keys until the correct one is found. It relies on automated guessing rather than a flaw in the software, so its success depends entirely on the strength of the password or key. The National Institute of Standards and Technology (NIST) sets the password and authentication guidance that defends against it.

What Is a Brute Force Attack?

A brute force attack is a cyberattack that systematically tries many combinations of passwords or keys until the correct one is found. It uses automation to test guesses at high speed, succeeding against weak or short credentials. The defining traits are:

• Systematic guessing works through combinations in sequence or from a list rather than exploiting a flaw.
• Automation uses software to submit guesses far faster than a person could.
• Credential or key target: passwords, PINs, API keys, or encryption keys.
• Strength dependence means success rises sharply against short or common credentials.

A brute force attack is one of the most common access attacks within the overview of what a cyberattack is. The same guessing technique appears among the common network attacks that target network logins.

How Does a Brute Force Attack Work?

A brute force attack works by using automated software to submit large numbers of password or key guesses against a target until one succeeds. It runs against a login, a stolen hash, or an encrypted file. The mechanism in order:

• Target selection picks a login form, a captured password hash, or an encrypted file.
• Guess generation builds candidates from sequences, wordlists, or leaked credential databases.
• Automated submission tests each candidate rapidly until one matches.
• Success occurs when a guess equals the password or key, granting access.

The number of possible combinations sets the time required, per NIST. Longer and more varied credentials push the combination count beyond what an attacker can test in any practical time.

What Are the Types of Brute Force Attacks?

The main types are simple brute force, dictionary attacks, credential stuffing, password spraying, and rainbow table attacks. Each describes how the attacker generates and applies guesses:

Credential stuffing and password spraying exploit reused and common passwords rather than testing every combination, per NIST. Credential stuffing depends on leaked data, which often originates from a data breach at another service.

Why Do Weak and Reused Passwords Fail?

Weak and reused passwords fail because short or common passwords have few combinations to test, and reused passwords let one breach unlock many accounts. A brute force attack succeeds fastest against low-entropy credentials:

• Short passwords have few possible combinations, which automated guessing tests quickly.
• Common passwords appear in wordlists, so a dictionary attack finds them early.
• Reused passwords let a single leaked credential unlock every account that shares it.
• Predictable patterns such as names and dates narrow the guesses an attacker must try.

How Long Does a Brute Force Attack Take?

The time depends on password length, character variety, the attacker’s computing power, and the hash, ranging from seconds for short passwords to billions of years for long ones. Each added character multiplies the combinations to test. The 2025/2026 Hive Systems table (12x NVIDIA RTX 5090, bcrypt work factor 10) shows the gap:

• 8 characters, numbers only: about 15 minutes; 8 lowercase letters: about 3 weeks.
• 8 characters, full set (upper, lower, numbers, symbols): about 165 years.
• 13 characters, full set: about 56 billion years, which is why Hive recommends 13+ characters.
• Hashing speed matters: a fast hash like MD5 falls in hours where slow bcrypt holds for centuries.

Chart bars use a log scale (each step is roughly a thousandfold longer). A short common password falls in seconds, while a long random passphrase resists guessing far beyond a practical timeframe, per NIST entropy guidance.

How Do You Defend Against a Brute Force Attack?

Defense uses long unique passwords, multi-factor authentication, rate limiting, account lockout, and salted password hashing. These controls raise the cost of guessing and limit the value of a correct guess:

• Long unique passwords push the combinations beyond a practical limit and stop reuse from spreading a breach.
• Multi-factor authentication or passkeys add a second factor, so a guessed password alone fails.
• Rate limiting slows repeated login attempts, cutting the guesses an attacker can submit.
• Account lockout blocks an account after a set number of failed attempts.
• Salted slow hashing stores passwords with a unique salt, defeating precomputed rainbow tables.

Two-factor authentication defeats a brute force attack even when a password is guessed, the protection in the steps to set up two-factor authentication. Rate limiting and lockout cut the guesses an attacker can attempt against a login.

How Does Two-Factor Authentication Stop Brute Force Attacks?

Two-factor authentication stops brute force attacks by requiring a second verification factor, so a correctly guessed password alone does not grant access. It adds a barrier that guessing cannot cross:

• Second factor requirement: a code, key, or biometric on top of the password.
• Guessed-password resistance blocks access even after a brute force attack finds the password.
• Phishing-resistant options such as hardware security keys and passkeys resist interception of the second factor.
• Alert generation can warn a user when a second factor is requested unexpectedly.

Two-factor authentication makes a guessed password insufficient, which is why NIST recommends it for accounts holding sensitive data. Pair it with a strong unique password to raise both the guessing cost and the barrier after a successful guess.

How Does Password Hashing and Salting Defend Against Brute Force?

Hashing and salting store passwords as irreversible hashes with a unique salt, so stolen hashes resist precomputed and reused attacks. They protect stored credentials even after a breach:

• Hashing converts a password into a fixed irreversible value that hides the original.
• Salting adds a unique random value before hashing, so identical passwords produce different hashes.
• Rainbow table defense follows, because a unique salt makes precomputed tables useless.
• Slow hash functions such as bcrypt, scrypt, and Argon2 raise the time each guess requires.

Salting defeats rainbow tables, and slow hash functions raise the cost of each guess, per NIST password storage guidance. Fast hashes like MD5 and SHA-1 are unsuitable for passwords; storing salted slow hashes limits the damage when a database is stolen.

What Is the Difference Between Online and Offline Brute Force Attacks?

An online brute force attack guesses against a live login system, while an offline attack guesses against a stolen password hash without contacting the service. The setting decides which defenses apply:

• Online attacks submit guesses to a running login, where rate limiting and lockout slow the attacker.
• Offline attacks test guesses against a captured hash at full speed, with no service to slow them.
• Online defenses rely on lockout, rate limiting, and detection of repeated failures.
• Offline defenses rely on slow salted hashing, which raises the cost of each guess.

Online attacks are slowed by lockout and rate limiting; offline attacks are slowed by salted slow hashing, per NIST. A long unique password defends both settings, the subject of the steps to create a strong password.

Can a Brute Force Attack Break Encryption?

A brute force attack can break encryption only when the key is short or weak, because modern key lengths create more combinations than any attacker can test in a practical time. Key length decides whether brute force is feasible:

• Key length sets the number of possible keys, and longer keys raise that count exponentially.
• AES-256 creates a key space far beyond the reach of current computing power.
• Short or outdated keys such as broken legacy ciphers fall to brute force.
• Weak passwords protecting an encrypted file remain the practical weak point, not the cipher itself.

Strong encryption with a sufficient key length resists brute force, so attackers target the password protecting the key instead, per NIST. Tools that derive keys from weak passwords stay vulnerable, which is why the encryption software guide stresses strong passphrases.

Last Thoughts on Brute Force Attacks

A brute force attack systematically tries many combinations of passwords or keys until one succeeds, relying on automated guessing rather than a software flaw. Simple, dictionary, credential stuffing, password spraying, and rainbow table variants each generate guesses differently, and weak or reused passwords fail fastest. Length beats complexity, so a long unique passphrase backed by multi-factor authentication, rate limiting, account lockout, and salted slow hashing is the durable defense. Continue with the steps to create a strong password, the guide to set up two-factor authentication, the overview of what a cyberattack is, or the introduction to cybersecurity.

Key Takeaways:

• A brute force attack systematically tries combinations until a password or key matches.
• The mechanism is automated guessing, not a software flaw, so credential strength decides the outcome.
• The types are simple, dictionary, credential stuffing, password spraying (reverse), and rainbow tables.
• Length beats complexity: each added character multiplies the keyspace far faster than a wider character set.
• Defense stacks long unique passphrases, MFA or passkeys, rate limiting, and account lockout.
• Slow salted hashing (bcrypt, Argon2) protects stored passwords and defeats rainbow tables.

Frequently Asked Questions (FAQs)