What Is a Brute-Force Attack? Explained Simply

What a brute-force attack is

A brute-force attack is one of the simplest and oldest hacking techniques: an attacker systematically tries a huge number of possible passwords, keys, or combinations until the correct one is found. There is no cleverness to it, just relentless trial and error, usually automated so a computer can attempt enormous numbers of guesses quickly. Despite its crudeness, brute force remains a real threat against weak passwords and poorly protected systems.

How it works

In a basic brute-force attack against a password, software tries every possible combination of characters, or runs through a list of likely passwords (a 'dictionary attack'). Because computers can attempt many guesses per second, short or simple passwords can fall quickly. Attackers may target a login page directly, or, if they have stolen a database of password hashes, try guesses offline where there are no limits on how fast they can go.

Why length and complexity matter

The defense that matters most is password strength. Each additional character, and each additional type of character (uppercase, lowercase, numbers, symbols), multiplies the number of possible combinations an attacker must try. A short, simple password has few possibilities and falls fast; a long, varied passphrase has so many that trying them all would take impractically long, even for fast computers. This is why length is the single biggest factor in resisting brute force.

Rate limiting and lockouts

Systems defend against online brute force by limiting how many guesses can be made. After a few failed login attempts, a service may slow down responses, require a CAPTCHA, or temporarily lock the account. These measures turn an attack that relies on millions of rapid guesses into one that would take far too long to be worthwhile. Rate limiting is one of the most effective and common defenses against brute-force login attempts.

Two-factor authentication

Even if an attacker guesses your password, two-factor authentication (2FA) stops them. With 2FA, logging in requires a second factor, a code from your phone or an authentication app, that the attacker does not have. Brute-forcing the password alone is no longer enough. This is why enabling 2FA is one of the single most effective steps you can take to protect accounts against brute force and other password-based attacks.

Why it matters

Understanding brute-force attacks clarifies why the familiar security advice actually works. Long, unique passwords, ideally made and stored by a password manager, make brute force impractical. Rate limiting protects login pages, and 2FA provides a backstop even if a password is compromised. Knowing how the attack works turns abstract rules into clear reasons, and motivates the habits that keep your accounts safe from the internet's most basic, but still dangerous, attack.

Related on Skillo

See also: Strong passwords vs passphrases explained, What is two-factor authentication (2FA)?.

Sources

• Brute-force attack - Wikipedia

Published date reflects the original event date (2025-03-04). This article is original Skillo editorial written from the sources above; facts were verified in September 2026.