Brute Force Attack

A brute force attack is a method of guessing credentials or cryptographic keys by systematically trying many possibilities until the correct one is found.

Why it matters

Short or common passwords fall quickly. Online attacks against login forms can be limited through rate limiting, lockouts and MFA, while offline attacks against stolen hashes depend on how slow the hashing function is. Length and randomness matter more than complexity rules.

Example

A password of 8 lowercase letters has about 200 billion combinations, which is trivial for modern hardware attacking a fast hash. A 16-character random password is vastly beyond reach, and a slow hash such as Argon2 raises the cost further.

Common mistakes

• Using short passwords because a lockout exists, when offline attacks ignore it.
• Leaving SSH or admin pages open to the internet with password-only login.
• Hashing passwords with a fast function such as MD5.

Related

• Credential stuffing
• Rate limiting
• Hashing
• MFA
• Tool: Port checker

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.