Prevent Brute Force Attacks: 7 Real Defenses

Brute force attacks are automated attempts to guess your password or encryption key by trying every possible combination until one works. You can prevent them by using long, random passwords, enabling rate limiting and account lockouts, and implementing multi-factor authentication (MFA). The following sections explain how these attacks work, why they succeed, and the specific measures you can take to stop them.

Formula

The calculator estimates how long it takes to try every possible password in a given set, assuming a constant guessing rate. The formula is:

Time (hours) = N / (R × 3600)

• N = number of possible passwords (for a password of length L with C possible characters, N = C^L).
• R = guesses per second (depends on the attacker’s hardware and the target’s rate limiting).
• 3600 = seconds per hour.

The second output converts the same result to days for easier reading.

Worked Example

Using the default values: N = 1,000,000,000,000 (10^12) possible passwords and R = 1,000 guesses per second.

1. First, compute the number of seconds: 10^12 / 1,000 = 1,000,000,000 seconds.
2. Convert to hours: 1,000,000,000 / 3600 ≈ 277,777.78 hours.
3. Convert to days: 277,777.78 / 24 ≈ 11,574.07 days (about 31.7 years).

The calculator shows 277,777.78 hours and 11,574.07 days for the defaults.

What Is a Brute Force Attack?

A brute force attack is a trial-and-error method used to obtain information such as a password, PIN, or encryption key. The attacker systematically checks all possible combinations until the correct one is found. For example, a 4-digit PIN has 10,000 combinations (0000 to 9999). At 1,000 guesses per second, that takes just 10 seconds to exhaust. In contrast, a 12-character password using uppercase, lowercase, digits, and symbols has about 95^12 ≈ 5.4 × 10^23 combinations, which at the same rate would take billions of years.

There are several subtypes:

• Simple brute force: tries every possible combination without any prior knowledge.
• Dictionary attack: uses a list of common passwords and words, often with variations (e.g., “Password1â€�, “P@ssw0rdâ€�).
• Hybrid attack: combines dictionary words with random characters or numbers.
• Credential stuffing: uses username/password pairs leaked from other sites, relying on people reusing passwords.

Why Do Brute Force Attacks Succeed?

Brute force attacks succeed for two main reasons: weak passwords and lack of rate limiting. Weak passwords are short, use common words, or follow predictable patterns (e.g., “123456�, “qwerty�, “letmein�). Attackers also exploit the fact that many people reuse the same password across multiple accounts. Even a strong password can be cracked if the server allows unlimited guesses without delay. For example, an attacker with a botnet of thousands of compromised devices can send millions of login requests per minute to a service that has no lockout or throttling.

Another factor is the rise of specialized hardware. Graphics processing units (GPUs) and custom chips (like ASICs) can perform billions of hash calculations per second, dramatically speeding up offline attacks on stolen password hashes. However, online brute force attacks (those that try to log in directly) are slower because each guess requires a network round trip and the server’s processing time.

How to Prevent Brute Force Attacks

There is no single silver bullet. Effective prevention uses multiple layers. Here are the most important measures:

• Use long, random passwords: Length is the most important factor. A 16-character password with mixed characters is exponentially harder to guess than an 8-character one. Use a password manager to generate and store them.
• Enable multi-factor authentication (MFA): Even if the attacker guesses the password, they still need a second factor (e.g., a code from an app or a hardware key). This stops most automated attacks.
• Implement rate limiting: Limit the number of login attempts per IP address or per account within a time window. For example, allow only 5 attempts per minute, then require a CAPTCHA or temporary lockout.
• Use account lockout: After a certain number of failed attempts (e.g., 10), lock the account for a period (e.g., 15 minutes) or until the user resets the password. This makes brute force impractical.
• Deploy CAPTCHAs: Require solving a CAPTCHA after a few failed attempts to slow down automated scripts.
• Monitor and alert: Log failed login attempts and set up alerts for unusual patterns, such as many attempts from one IP or at odd hours.
• Use a Web Application Firewall (WAF): A WAF can detect and block malicious traffic, including brute force patterns, before it reaches your server.

How to Choose the Right Defense

The right mix depends on your situation. For a personal account, the most critical steps are using a unique, long password and enabling MFA. For a website or application, you need server-side protections: rate limiting, lockout policies, and CAPTCHAs. For high-security systems (e.g., banking, government), consider hardware security keys (e.g., FIDO2) and strict IP allowlisting. Also, consider the threat model: an attacker targeting a specific person may use a dictionary attack, while a broad attack on a service may use credential stuffing. Tailor your defenses accordingly.

Common Mistakes and Misconceptions

One common mistake is relying solely on password complexity while ignoring length. “Tr0ub4dor&3� is harder to remember than “correct horse battery staple� but the latter is far more secure because it is longer. Another mistake is not protecting against credential stuffing: even if you have a strong password, if you reuse it elsewhere, a breach on another site can compromise your account. Also, some people think that a CAPTCHA alone is enough, but it only slows down automated attempts; it does not stop a determined human or a sophisticated bot. Finally, rate limiting based only on IP address can be bypassed by attackers using botnets with many IPs; consider also limiting by account and by device fingerprint.

Comparison: Online vs. Offline Attacks

It is important to distinguish between online and offline brute force attacks because the defenses differ. In an online attack, the attacker tries to log in directly to the service. Rate limiting, lockouts, and CAPTCHAs are effective here. In an offline attack, the attacker has obtained a copy of the password hashes (e.g., from a database breach) and tries to crack them on their own hardware. In that case, server-side rate limiting is useless; the only defense is using strong, unique passwords and using a slow hashing algorithm (like bcrypt, scrypt, or Argon2) on the server. If you are a user, you cannot control the server’s hashing algorithm, so your best defense is a long, random password that would take centuries to crack even offline.

Frequently Asked Questions

How long does it take to brute force an 8-character password?

Assuming 95 possible characters (uppercase, lowercase, digits, symbols), there are 95^8 ≈ 6.6 × 10^15 combinations. At 1 billion guesses per second (a fast offline attack), it would take about 6.6 million seconds, or about 76 days. With a slower online attack (e.g., 10 guesses per second), it would take over 20,000 years.

Does a longer password always help?

Yes, because the number of combinations grows exponentially with length. Adding one character multiplies the search space by the number of possible characters (e.g., 95). A 12-character password is 95^4 ≈ 81 million times harder to crack than an 8-character one. However, a very long but predictable password (e.g., “aaaaaaaaaaaaaaaa�) is still weak. Length helps only if the password is random or at least not a known pattern.

Is multi-factor authentication enough to stop brute force?

MFA dramatically reduces the risk, but it is not 100% foolproof. Attackers can sometimes bypass MFA through phishing (e.g., a fake login page that forwards the one-time code) or by exploiting “push fatigue� (repeatedly sending push notifications until the user accidentally approves). However, for most automated brute force attacks, MFA is an effective barrier because the attacker would also need the second factor.

What is the difference between brute force and dictionary attack?

A brute force attack tries every possible combination of characters, while a dictionary attack tries a precompiled list of likely passwords (words, common phrases, leaked passwords). Dictionary attacks are much faster because they only try a few million possibilities instead of trillions. They succeed when users choose common, predictable passwords. Hybrid attacks combine both: they take dictionary words and append numbers or symbols.

Can I prevent brute force attacks on my own computer?

Yes, for your own accounts and devices. Use a password manager to generate and store unique passwords for each site. Enable MFA wherever available. For your own server or application, implement rate limiting and lockout policies. Also, keep software updated to patch vulnerabilities that could allow attackers to bypass login protections.

What should I do if I think I’m being brute forced?

If you see many failed login attempts on your account, change your password immediately to a long, random one. Enable MFA if you haven’t. If you run a website, check your logs for the attacking IPs and block them. Consider using a service like Cloudflare or a WAF that offers brute force protection. Also, report the incident to your hosting provider if the attack is overwhelming your server.

Related

• 7 Days to Die Scheduled Server Messages Setup
• Cubic Yards of Gravel to Tons? Quick Guide
• Equation for E Cell: Nernst & Standard Potential

in t | Time to try all combos | hours | 24 | 0
in r | Guesses per second | per sec | 1000 | 1
in n | Number of possible passwords | - | 1e12 | 1
out time | Time to try all combos | hours | n / (r * 3600) | 2
out days | Equivalent in days | days | n / (r * 86400) | 2