A brute force attack is exactly what the name says: an automated attempt to guess a password by trying every possible combination until one works. No deception, no phishing email, no clever ruse — just software hurling millions of password candidates at a login page until the lock opens. It is the oldest attack on the internet, and in 2026 it still succeeds, because every reused or weak password gives it a chance.
TL;DR
- Brute force is automated password guessing: every combination, at millions of tries per second.
- Variants matter more than the base attack — credential stuffing reuses passwords stolen from other breaches, and dictionary attacks start with likely words.
- Modern attacks are cheap: toolkits run on rented cloud servers, and leaked password lists supply most of the guesses.
- The controls that actually stop it: MFA on every account, strong unique passwords, lockout and rate limits, and monitoring failed-login patterns.
- Staff need to know why password reuse is the risk multiplier — one breached site reopens every account that shares its password.
What brute force means in plain terms
A password is a lock whose key is a sequence of characters. Brute force walks through every sequence that could be a key: aaaaaaaa, aaaaaaab, aaaaaaac, and so on. The attacker's tool submits these guesses to a login page or an offline password file at machine speed.
Whether it succeeds is a race between two numbers: how many combinations exist, and how many guesses per second the attacker can make. Length drives the first number. A six-character password has a few billion combinations; a twelve-character one has more than ten thousand trillion. Speed drives the second. Attacking a web login is throttled by the site itself; attacking a stolen password database runs at billions of guesses per second on ordinary hardware.
That is why the practical advice — longer passwords, unique per site — is not trivia. It is arithmetic.
The four variants that actually hit businesses
Raw brute force is rare in the wild because it is slow and loud. These variants are what you will actually face:
- Credential stuffing. The most common by volume. Attackers feed login forms with email-and-password pairs stolen from earlier breaches of other sites, because people reuse passwords. One leaked forum password later unlocks a corporate account. This is why reused passwords are the top enabler of account takeover.
- Dictionary attacks. The tool tries real words, names, and common substitutions — Password1, Summer2026!, company-name plus year — before wasting time on impossible combinations.
- Password spraying. The inverse: take a few likely passwords (Welcome1, Spring2026) and try them across thousands of usernames, one attempt per account. It evades lockouts because no single account sees enough failures to trip them.
- Hybrid and mask attacks. Wordlists with rules: capitalise the first letter, append two digits, swap letters for numbers. These crack most human-made passwords quickly once the database is in the attacker's hands.
Every one of these feeds on the same raw material: passwords humans chose, reused or recycled. The stolen-credential economy connects it all — a breach anywhere becomes a login attempt everywhere.
What a brute force attack looks like from the inside
| Signal | What you would see | What it usually means |
|---|---|---|
| Burst of failed logins on one account | Hundreds of failures in minutes | Raw brute force or dictionary attack on that user |
| A few failures on thousands of accounts | 1-5 failures per account, fleet-wide | Password spraying |
| Successful login following known-bad credentials | Credential pair from a public breach list | Credential stuffing |
| Logins from impossible locations | New country or ASN within minutes of the last | Account already taken over |
None of this requires exotic tooling to detect — only logs that someone reads. Most small businesses never look, which is why the attacks quietly succeed.
How to stop brute force attacks
The controls are boring and effective, in order of impact:
- Multi-factor authentication on everything. A guessed password alone is no longer enough. This single control neutralises the entire attack class for any account that has it.
- Unique passwords, stored in a password manager. Unique stops credential stuffing; length stops offline cracking. A manager makes both free for staff.
- Lockout and rate limiting. Lock accounts after repeated failures, throttle attempts, and use progressive delays. This kills raw brute force on any internet-facing login.
- Monitor authentication logs. Alert on spray patterns — many accounts, few failures each — not just per-account lockouts.
- Check credentials against breach lists. Force a reset when an employee's password appears in a new dump. Services like Have I Been Pwned exist for exactly this; we have a plain-English guide to it.
- Train the people layer. Staff who understand that one reused password can reopen every account they own will actually use the password manager. Cyber Aware's security awareness training makes that case in monthly, digestible modules, and human risk reporting shows whether the habit is sticking.
Brute force vs credential stuffing vs phishing: three doors into the same house
| Brute force | Credential stuffing | Phishing | |
|---|---|---|---|
| How it gets in | Guesses the password | Tries passwords leaked elsewhere | Tricks the user into handing it over |
| Depends on | Weak or short passwords | Password reuse | Human trust and urgency |
| Visibility | Noisy — log floods | Quiet — logins look normal | Depends on the click |
| Main defence | MFA, lockouts, length | Unique passwords per site | Trained reporting reflex |
The three attacks use different doors, but MFA, unique passwords and a trained team close all three at once. That overlap is the reason layered training and identity controls are worth doing together rather than one at a time.
FAQ
What is a brute force attack in simple terms? An automated program guesses passwords by trying as many combinations as possible until one works. It is pure trial and error at machine speed.
How long does a brute force attack take? It depends on password length and where the attack runs. Short passwords fall in seconds when the attacker has the password file; long, random ones are mathematically impractical to crack. Against a protected login page, rate limiting and lockouts make the attack take effectively forever.
Does MFA stop brute force attacks? Yes — for accounts with MFA enabled. A guessed or stolen password becomes just the first of two required factors. This is why enabling MFA everywhere is the highest-value single control for this attack class.
What is password spraying? A brute force variant that tries a handful of common passwords across many usernames, one attempt each, to stay under lockout thresholds. It is the version most likely to hit your organisation without triggering an obvious alarm.
What should staff be told about brute force attacks? Two things: never reuse a work password anywhere else, and let the password manager generate long ones. Both rules come from the same math — reuse turns every other site's breach into your breach, and length makes guessing impractical.
One last thing
Check your login pages today for two settings: account lockout after repeated failures, and rate limiting on authentication attempts. If either is missing, an attacker can guess indefinitely and you will only find out from the aftermath. Then confirm MFA is on for every admin and remote-access account — that is where these attacks aim first.