Brute-force attack
Breaking into an account by trying passwords, one after another, until one works.
A brute-force attack is the least clever way to get into an account, and still one of the most common: a program tries passwords over and over until one is accepted. It does not exploit a flaw in the software. It relies on the password being short, common, or already known.
Attackers rarely try every possible combination, because that takes too long. A dictionary attack starts with the passwords people actually use, like 123456, names, sports teams and keyboard patterns, plus common tweaks such as adding a year. Credential stuffing goes one step further: it takes email and password pairs leaked from one site and tries them on others, betting that people reuse passwords. When a company's password database is stolen, attackers can also guess at full speed on their own machines, offline, without any login page to slow them down.
The math favors long passwords. Each extra character multiplies the number of possibilities, so a long passphrase of four random words is far harder to guess than a short password full of symbols. That is why a password manager, which creates a long, different password for every site, defeats most of these attacks, and why two-factor authentication helps even when the password is guessed.
Services defend themselves too: they limit how many attempts each account or address can make, add delays or a CAPTCHA after failures, alert you about strange logins, and store passwords with deliberately slow hashing so a stolen database is expensive to crack.
Keep in mind
- It guesses passwords instead of exploiting a bug, so weak and reused passwords are the target.
- Credential stuffing reuses passwords leaked from other sites.
- Length beats complexity: each extra character multiplies the work.
- Unique passwords from a password manager plus 2FA stop almost all of it.
