Brute Force Attack

A brute force attack tries to guess a password, PIN or encryption key by trying a huge number of possibilities until one works. A dictionary attack tries common passwords and words first, and credential stuffing tries username and password pairs leaked from other websites.

Defences include long, unique passwords (each extra character multiplies the work), rate limiting and temporary lockouts after failed attempts, CAPTCHAs, two-factor authentication, and storing passwords with slow hashing algorithms such as bcrypt or Argon2 so stolen hashes are expensive to crack.