Brute Force Attack: What It Is & How to Stop It

Updated 5 November 2026 · Standard formula, shown below

A brute force attack is a trial-and-error method used to obtain passwords, PINs, or encryption keys by systematically trying every possible combination until the correct one is found. This article explains how these attacks work, why they still succeed, and the practical steps you can take to defend against them.

How Brute Force Attacks Work

At its core, a brute force attack is simple: an attacker uses automated software to guess credentials at high speed. The software can try thousands or even millions of combinations per second, depending on the attacker’s hardware and the target’s security measures. There are several common variations:

Simple brute force: Tries every possible combination of characters, from “a” to “ZZZZ…”
Dictionary attack: Uses a list of common passwords, phrases, and leaked passwords (like “123456” or “password”).
Hybrid attack: Combines dictionary words with variations, such as adding numbers or symbols (e.g., “password123!”).
Credential stuffing: Uses username/password pairs leaked from other sites, relying on people reusing passwords.

The attack can target login forms, API endpoints, SSH servers, or encrypted files. The success rate depends on password complexity, length, and whether the system has rate limiting or lockout policies.

Why Brute Force Still Works

You might think that modern systems would be immune, but brute force attacks remain effective for several reasons:

Weak passwords: Many users still choose short, predictable passwords. A 6-character lowercase password has only 26^6 (about 309 million) possibilities, which a modern GPU can exhaust in seconds.
Reused passwords: Credential stuffing exploits the fact that people reuse passwords across multiple sites. A breach on one site gives attackers a list of valid credentials to try elsewhere.
No rate limiting: Some systems do not limit login attempts, allowing attackers to try endlessly without being blocked.
Offline attacks: If an attacker obtains a password hash (e.g., from a database leak), they can brute force it offline, where there are no login attempt limits. The speed depends on the hash algorithm (e.g., MD5 is fast, bcrypt is slow).

How to Protect Yourself

Defending against brute force attacks requires a combination of user habits and system configuration. Here are the most effective measures:

Use long, random passwords: Length is the most important factor. A 12-character password with mixed case, numbers, and symbols has 94^12 possibilities, making brute force impractical.
Use a password manager: It generates and stores unique passwords for each account, so you don’t have to remember them.
Enable two-factor authentication (2FA): Even if an attacker guesses your password, they still need the second factor (e.g., a code from your phone).
Never reuse passwords: Use a unique password for each important account (email, banking, social media).
Change default credentials: Routers, IoT devices, and admin panels often ship with default usernames/passwords like “admin/admin.” Change them immediately.

How System Administrators Can Mitigate Attacks

If you manage a server or application, you can implement several technical controls to slow down or stop brute force attempts:

Rate limiting: Limit the number of login attempts per IP address or account within a time window (e.g., 5 attempts per minute).
Account lockout: Temporarily lock an account after a certain number of failed attempts (e.g., 10 attempts for 15 minutes).
CAPTCHA: Require a CAPTCHA after a few failed attempts to block automated tools.
Use strong hashing algorithms: For password storage, use bcrypt, scrypt, or Argon2, which are computationally expensive and slow down offline brute force attacks.
Monitor logs: Watch for unusual spikes in failed login attempts and block suspicious IPs.
Use a Web Application Firewall (WAF): Many WAFs have built-in brute force protection.

Brute Force vs. Other Attack Types

Brute force is often confused with other attack methods, but they are distinct:

Phishing: Tricks users into revealing passwords voluntarily, rather than guessing them.
Keylogging: Malware records keystrokes to capture passwords as they are typed.
Man-in-the-Middle: Intercepts communication to steal credentials in transit.
Rainbow table attack: Uses precomputed hash tables to reverse password hashes, but is less effective against salted hashes.

Brute force is a numbers game; it relies on persistence and computing power, while other attacks exploit human error or system vulnerabilities.

Real-World Examples and Impact

Brute force attacks have been implicated in many high-profile breaches. For example, in 2019, a large collection of leaked passwords (the “Collection #1” breach) contained over 2.6 billion unique credentials, which attackers used for credential stuffing. In 2020, a brute force attack on the Twitter admin panel led to a major account takeover incident. These events highlight how a single weak password can compromise an entire system.

The impact of a successful brute force attack can be severe: data theft, financial loss, reputational damage, and legal consequences. For individuals, a compromised email account can lead to identity theft or further attacks on other accounts.

Frequently Asked Questions

How long does it take to brute force a password?

It depends on the password length, complexity, and the attacker’s hardware. A 6-character lowercase password can be cracked in seconds on a modern GPU, while a 12-character password with symbols could take centuries. Offline attacks on fast hashes (like MD5) are much quicker than online attacks against a login form with rate limiting.

What is the difference between brute force and dictionary attack?

A brute force attack tries every possible combination of characters, while a dictionary attack only tries words from a predefined list (often common passwords or leaked data). Dictionary attacks are faster but less thorough; brute force is exhaustive but slower.

Can a VPN protect against brute force attacks?

No. A VPN hides your IP address, but it does not protect your accounts from being targeted. If an attacker is brute forcing a server, they are not targeting your IP; they are targeting the server’s login page. A VPN does not change the strength of your passwords or the server’s security.

Is a long password always better than a complex one?

Yes, length is generally more important than complexity. A 15-character password using only lowercase letters (26^15 â‰ˆ 1.7e21 combinations) is much stronger than an 8-character password with symbols (94^8 â‰ˆ 6e15 combinations). However, combining both length and complexity is best.

What should I do if I think I’ve been a victim of a brute force attack?

Immediately change the password for the affected account and any other accounts that use the same password. Enable two-factor authentication if available. Check for suspicious activity (e.g., sent emails, changed settings). If the account is critical, contact the service provider’s support.

Are brute force attacks illegal?

Yes, attempting to access a computer system without authorization is illegal in most countries, even if the attempt is unsuccessful. Laws like the Computer Fraud and Abuse Act (CFAA) in the US and similar legislation elsewhere criminalize unauthorized access. Security professionals only test systems with explicit permission.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.