# Brute-force attack

> Breaking into an account by trying passwords, one after another, until one works.

- Level: Basic
- Topics: Security
- URL: https://tidbit.legios.com.ar/brute-force-attack/
- In Spanish: [Ataque de fuerza bruta](https://tidbit.legios.com.ar/es/brute-force-attack/)

A **brute-force attack** is the least clever way to get into an account, and still one of the most common: a program tries passwords over and over until one is accepted. It does not exploit a flaw in the software. It relies on the password being short, common, or already known.

Attackers rarely try every possible combination, because that takes too long. A **dictionary attack** starts with the passwords people actually use, like `123456`, names, sports teams and keyboard patterns, plus common tweaks such as adding a year. **Credential stuffing** goes one step further: it takes email and password pairs leaked from one site and tries them on others, betting that people reuse passwords. When a company's password database is stolen, attackers can also guess at full speed on their own machines, offline, without any login page to slow them down.

The math favors long passwords. Each extra character multiplies the number of possibilities, so a long passphrase of four random words is far harder to guess than a short password full of symbols. That is why a password manager, which creates a long, different password for every site, defeats most of these attacks, and why two-factor authentication helps even when the password is guessed.

Services defend themselves too: they limit how many attempts each account or address can make, add delays or a CAPTCHA after failures, alert you about strange logins, and store passwords with deliberately slow hashing so a stolen database is expensive to crack.

## An analogy

A thief standing at a combination lock with patience and a list of the most popular codes. A four-digit bike lock falls quickly; a long combination, or a lock that jams after five wrong tries, makes the whole approach useless.

## Keep in mind

- It guesses passwords instead of exploiting a bug, so weak and reused passwords are the target.
- Credential stuffing reuses passwords leaked from other sites.
- Length beats complexity: each extra character multiplies the work.
- Unique passwords from a password manager plus 2FA stop almost all of it.

## Go deeper

- [Brute force attack (OWASP)](https://owasp.org/www-community/attacks/Brute_force_attack)
- [Use strong passwords (CISA)](https://www.cisa.gov/secure-our-world/use-strong-passwords)
- [Brute-force attack on Wikipedia](https://en.wikipedia.org/wiki/Brute-force_attack)

## Related terms

- [Database](https://tidbit.legios.com.ar/database/): An organized store of data that programs can search and update safely.
- [Password manager](https://tidbit.legios.com.ar/password-manager/): An encrypted vault that remembers a different strong password for every site.
- [Two-factor authentication](https://tidbit.legios.com.ar/two-factor-authentication/): A second proof that you are you, so a stolen password alone is not enough.
- [CAPTCHA](https://tidbit.legios.com.ar/captcha/): A small test a website uses to tell a person from an automated program.
- [Hashing](https://tidbit.legios.com.ar/hashing/): A one-way fingerprint of data: easy to compute, not meant to be reversed.
- [Bug](https://tidbit.legios.com.ar/bug/): A mistake in software that makes it behave differently from what was intended.