What is a Brute-Force Attack?

How a brute-force attack works

The attacker points automated software at a target and lets it guess until something works. The tooling is cheap, the method is decades old, and it still pays off because weak and reused passwords are everywhere. You'll also see the technique called an “exhaustive key search.”

Where the guessing happens changes everything. An online attack sends bots against a live login form, so rate limits, lockouts, and CAPTCHAs can slow it to a crawl. An offline attack starts from a stolen database of password hashes (scrambled versions of stored passwords) and runs on the attacker's own hardware at full speed, where no login limit applies. That's the scenario password-cracking benchmarks measure.

How long cracking a password takes

Anywhere from days to centuries; length is the biggest lever. An 8-character password using only lowercase letters has about 209 billion possible combinations (26⁸), and each character you add multiplies that number by the size of the character set. Hive Systems' 2026 Password Table, published July 14, 2026, models an attacker renting 16 RTX 5090 graphics cards to crack bcrypt password hashes offline. On that rig, an 8-character all-lowercase password falls in about 2 weeks, while 8 characters mixing numbers, upper- and lowercase letters, and symbols hold out for roughly 132 years. The same mixed password took 225 years to crack in 2024 and 164 in 2025; crack times drop 20% to 25% every year as hardware gets cheaper to rent.

Hive's takeaway is that length remains the single best defense: each added character multiplies the crack time far more than swapping in a symbol does. Stretch a random mixed password to 16 characters and the estimate runs thousands of times past the age of the universe, which is why a password manager, not a clever substitution scheme, is the practical fix. Encryption keys are a different story. Brute force can break short or outdated keys (the Electronic Frontier Foundation built a machine in 1998 that cracked 56-bit DES keys in a matter of days), but modern 128- and 256-bit keys are computationally infeasible to search. Attackers know it, so they go after weak passwords instead.

Types of brute-force attacks

Four variants count as brute force in the strict sense, and only the first one actually tries everything:

• Simple brute-force attack: works through every possible character combination blind. Only practical against short passwords and PINs.
• Dictionary attack: runs a list of common words and previously leaked passwords against one account instead of trying everything.
• Hybrid attack: mixes dictionary words with number and symbol mutations to catch passwords like NewYork1993.
• Reverse brute-force attack: starts with one known or common password and tries it against many usernames.

Two related login attacks usually get grouped with brute force because the same defenses stop them, but neither one guesses its way through combinations:

• Credential stuffing: replays real username-and-password pairs leaked in one breach across other sites, betting on password reuse. No guessing involved.
• Password spraying: tries a few common passwords against many accounts, staying below lockout thresholds.

One thing a brute-force attack is not: a DDoS attack. Brute force tries to break in; a DDoS tries to knock your site offline with junk traffic.

What happens when a brute-force attack succeeds

For a user, a cracked account feeds fraud and identity theft, and the stolen password gets replayed against every other site the attacker can find. For a site owner, a guessed admin password hands over the entire site: attackers inject malware, deface pages, steal customer data, send spam from your server, and get your domain flagged as dangerous by search engines.

If you discover an unauthorized login, work through this sequence: lock or disable the affected account, reset its password along with every other account that reused it, and sign out active sessions and revoke app passwords and API keys. Then inspect your logs and site files for changes you didn't make, remove anything malicious or restore a verified clean backup, and check whether breach-notification rules apply to the data that was exposed.

Signs your site is under attack

A brute-force attempt is noisy if you know where to look. Watch for a spike in failed login attempts in your server or authentication logs, repeated requests to your login URL from rotating IP addresses, users locked out of accounts they didn't touch, and a login page that suddenly crawls.

See that pattern? Confirm it in the logs, block the offending IP addresses at your firewall, then turn on rate limiting and two-factor authentication so the next wave hits a wall.

How to prevent brute-force attacks

Start with two-factor authentication (2FA): once it's on, a guessed password alone won't get an attacker in. Then layer the rest, in order of impact:

• Two-factor authentication: a correctly guessed password is no longer enough by itself. Phishing-resistant factors, like passkeys or hardware security keys, hold up better than texted or emailed codes.
• Long, unique passwords: length multiplies cracking time, and uniqueness makes credential stuffing useless. A password manager handles both.
• Rate limiting and lockouts: limit login attempts in a set window so online guessing stalls after a handful of tries.
• CAPTCHA and bot challenges: these cut automated form submissions, though determined bots can slip past, so treat them as backup for the controls above, not a primary defense. Cloudflare Turnstile is a free option that checks most visitors without showing a puzzle.

The first two protect you as a user everywhere. The last two are server-side controls only a site owner can set up, and attackers actively hunt for login forms that lack them. If you run WordPress, work through our WordPress security guide next; it covers all of these step by step.