A brute force attack is an automated attempt to break into an account by trying password after password until one works — no trickery, just volume. This guide explains how brute force works, how long it takes to crack a password in 2026, the smarter variants attackers use, and the controls that stop it.
TL;DR
- A brute force attack tries every possible password combination until one unlocks the account.
- Credential stuffing and password spraying are targeted variants: they use stolen or predictable passwords instead of random guesses.
- Multi-factor authentication (MFA) is the primary defence; a guessed password alone should never be enough to log in.
- Longer passwords win: each extra character multiplies the combinations an attacker must try.
- Cyber Aware's security awareness training covers the password habits that make brute force impractical.
What a brute force attack actually does
Brute force is the oldest attack on the list and it has not changed in decades: software fires login attempts at a target account, cycling through combinations — aaa, aab, aac — until something opens. The attacker supplies nothing but automation and patience. Everything depends on arithmetic: each additional character in a password multiplies the number of guesses required, and each new guess costs the attacker time.
In 2026 the economics are lopsided. Offline attacks — where the attacker has stolen a password file and can guess at full speed against it — crack short passwords quickly. Online brute force, the kind aimed at a live login page, is throttled by rate limits, lockouts and MFA. That is why the real-world question is not "can my password be guessed" but "does my login let someone guess at all".
The brute force family: four variants to know
| Variant | How it works | What it targets |
|---|---|---|
| Pure brute force | Tries every possible combination, character by character | Short, simple passwords; old offline dumps |
| Dictionary attack | Tries real words and common passwords first | Passwords like Summer2026! or Welcome1 |
| Credential stuffing | Replays username and password pairs stolen from other breaches | Staff who reuse passwords across services |
| Password spraying | Tries a handful of common passwords across many accounts | Whole user lists — avoids account lockouts by staying quiet |
The variants matter because each one beats a different bad habit. Pure brute force beats short passwords; dictionary attacks beat human-predictable ones; credential stuffing beats password reuse; password spraying beats whole teams that share a naming pattern.
Credential stuffing deserves a note of its own. Breach databases circulate freely, and automation tests your staff's old forum and shopping-site passwords against your systems in minutes. The credential stuffing guide covers why a password used anywhere else is a liability at work.
How long brute force actually takes
The honest answer is: it depends on two things — password length and whether the attacker can guess offline. Offline cracking is faster because there is no login page waiting between attempts. Online attacks against a live system are slow by design when the system fights back.
What is fixed is the maths. Each extra character multiplies the search space, which is why the practical rules are:
- Length beats complexity. A four-word passphrase is harder to crack than a short password stuffed with symbols, and easier to type.
- Uniqueness beats cleverness. A password used on one service is worth one attack; a reused password is worth every service it unlocks.
- Rate limits beat everything. A login page that locks or delays after repeated failures turns months of guessing into a dead end.
The attackers know this, which is why most 2026 campaigns skip pure brute force entirely and go straight to credential stuffing and spraying against accounts that lack MFA.
How to stop a brute force attack
- Turn on multi-factor authentication everywhere. This is the control that ends the debate. Even a cracked password is useless without the second factor. Cyber Aware's phishing simulations also target the MFA fatigue attacks that try to work around it.
- Set a password length floor of 14+ characters and block the top known-bad passwords. A passphrase beats a policy nobody follows.
- Rate-limit and lock out failed logins. Make online guessing slow and noisy, and alert on the noise.
- Ban password reuse across work and personal accounts. Staff email is the crown jewel — its password should exist nowhere else.
- Deploy a password manager. Unique, long passwords become effortless instead of aspirational.
- Check your exposure. A security gap assessment shows whether MFA, lockouts and password policy are actually in place across every system — or just the ones someone remembers.
Why this matters for Australian businesses
The threat is not hypothetical. The Australian Signals Directorate's Annual Cyber Threat Report 2024-25 recorded more than 84,700 cybercrime reports in 2024-25 — an average of one every six minutes — and put the average self-reported cost for a small business at $56,600 per incident, up 14 per cent. Stolen credentials remain one of the most common initial access routes, and brute force or its variants are how many of those credentials are obtained.
The training side matters more than most teams expect. KnowBe4's 2026 Phishing by Industry Benchmarking Report measured phishing susceptibility at 33.2% before training, falling to 4.2% after twelve months of monthly training. The phishing emails that harvest credentials feed the same credential-stuffing databases used in brute force variants — stopping the click stops the leak that fuels the attack.
FAQ
What is a brute force attack in simple terms? An automated attack that guesses password after password until one works. In 2026 most attacks use stolen password lists or common guesses rather than random combinations.
How long does it take to brute force a password? It depends on length and whether the attacker guesses offline or against a live login. Longer passwords multiply the work exponentially, and rate limits plus MFA make live guessing impractical.
What is the difference between brute force and credential stuffing? Brute force guesses passwords; credential stuffing replays username and password pairs stolen from other sites' breaches. Stuffing works whenever staff reuse passwords across services.
Does multi-factor authentication stop brute force attacks? Effectively, yes. A guessed password alone cannot log in, which removes the attacker's entire payoff. The remaining risk is MFA fatigue prompting, which training and number-matching address.
Are passphrases better than complex passwords? Generally, yes. Length drives the maths, and a passphrase of four or more random words is both longer and easier for staff to remember than a short symbol-heavy password.
How do I know if we are being brute forced? Your login logs tell you: clusters of failed sign-ins for one account, many accounts from one IP address, or failed attempts outside business hours. Alert on all three.
One last thing
Check one thing today: whether every system your staff log into has MFA switched on. Brute force is arithmetic, and MFA breaks the arithmetic — no other control on this list changes the odds as completely.