A brute force attack is a hacking method that systematically guesses login credentials, encryption keys, or other hidden information through trial and error. The attacker tries combination after combination until one works.
The name says it all. Rather than anything clever, the attacker relies on sheer persistence and computing power, hammering an account or a stolen password database until something matches. It's one of the oldest techniques in security, and it's still common because it still works, especially against short or reused passwords.
Depending on password strength and the hardware involved, a brute force attempt can take anywhere from a few seconds to longer than the age of the universe. The single best defense is long, random, unique passwords, which is exactly what a password manager makes practical. TeamPassword keeps your team's passwords strong, organized, and easy to manage. Start a free 14-day trial and protect your company's accounts.
How a brute force attack works
At its simplest, the attacker builds a list of possible passwords, tries each one, and keeps going until a login succeeds or a stolen password hash matches. In practice, almost no one does pure trial-and-error anymore. Attackers layer smarter techniques on top of raw guessing (dictionaries of common passwords, known breach data, predictable human patterns) so the "brute" part gets a lot more targeted.
The critical detail most people miss is where the guessing happens, because that changes everything about which defenses matter.
Online vs. offline brute force attacks
There are two very different scenarios, and they call for different protections.
Online attacks target a live login form. The attacker submits guesses to the actual website or service, which means they're subject to whatever that service enforces: account lockouts, rate limits, CAPTCHAs, and multi-factor authentication. These defenses make online brute forcing slow and noisy, so it rarely succeeds against a well-configured system.
Offline attacks are the real threat. Once an attacker steals a database of hashed passwords in a breach, they copy those hashes onto their own hardware and guess against them locally, with no lockout, no rate limit, and no alert to slow them down. As the security researchers at Hive Systems put it, the login page's "five strikes and you're out" rule does nothing once the hashes are on the attacker's machine. They can guess billions of times per second for as long as they like. Grab the hashes now, crack them later.
This is why strong, unique passwords matter even when a site has good lockout protection. Lockouts guard the front door; they do nothing once your hashed password is already in someone else's hands.
Types of brute force and related attacks
A textbook brute force attack cycles through every possible character combination, but most modern attacks are smarter. In a pure brute force scenario, "password" is technically as hard to guess as "aT./$x6m," but attackers combine techniques so that common or reused passwords fall far faster. Here are the main variants.
1. Simple brute force attacks
The attacker tries every possible combination in sequence. If a password were limited to six lowercase letters, it would start at "aaaaaa," move to "aaaaab," and grind on toward "zzzzzz." Exhaustive and guaranteed to work eventually, but hopelessly slow against longer, complex passwords.
2. Dictionary attacks
Instead of every combination, the attacker tries a precompiled list of likely passwords, often pulled from previous breaches, like "password123," "qwerty," or "letmein." Since so many people pick simple passwords, this is far more efficient than pure brute force.
3. Hybrid brute force attacks
A hybrid attack starts with a dictionary, then mutates each entry by adding numbers, symbols, or capitalization. After "password," it tries "Password1!" or "password1234." It preys on the predictable ways people dress up weak passwords to meet complexity rules.
4. Reverse brute force attacks
Here the attacker starts with a known password (often from a breach) and tries it against many usernames. It's devastating when people reuse passwords, since one leaked credential can unlock accounts across dozens of unrelated services.
5. Credential stuffing
Credential stuffing uses stolen username-and-password pairs against many sites at once. The attacker doesn't guess at all; they already have a valid pair and just need to find where else it works. Because password reuse is rampant, it's brutally effective.
Tools that power brute force attacks
None of this is to teach anyone to crack passwords. It's to show what you're actually up against when you secure a network. Attackers have built an entire ecosystem of tooling.
Automated cracking software removes the manual work, running dictionary and hybrid attacks, working against protocols like MySQL and Telnet, targeting wireless routers, and translating words into predictable variants (password, p4ssw0rd, Pa55WoRd).
Rainbow tables are precomputed tables of hash outputs. Scanning them lets an attacker skip the most expensive part of cracking, matching a stolen hash to its original text much faster (though modern salted hashing defeats this).
GPUs do the heavy lifting. Password cracking is enormous parallel arithmetic, and a graphics card's thousands of cores chew through hashes far faster than a general-purpose CPU. Combining multiple GPUs (or renting a cloud fleet of them) multiplies that speed further. The practical takeaway isn't a precise multiplier, which varies wildly by algorithm and hardware, but the direction: GPUs make offline cracking dramatically, often orders of magnitude, faster than a CPU alone.
How long does it take to crack a password?
Crack time depends on three things: the password's length and complexity, whether it's random, and the hashing algorithm protecting it. That last factor matters more than people expect. A fast, unsalted hash like MD5 can be guessed billions of times per second, while a deliberately slow, salted hash like bcrypt is far tougher.
Using bcrypt (the hashing method most commonly seen in real breaches), Hive Systems' 2026 password table estimates the following for a randomly generated password cracked offline on a rented multi-GPU (RTX 5090) fleet:
| Password | Estimated time to crack (2026, bcrypt) |
|---|---|
| 8 characters, lowercase only | ~2 weeks |
| 8 characters, upper + lower + numbers + symbols | ~132 years |
| Reused, dictionary-based, or previously breached password (any length) | Seconds |
A few things stand out. First, complexity and length buy you real protection: a random 8-character password with the full character mix jumps from crackable-in-weeks to over a century. Second, that same cell has been shrinking every year (about 225 years in 2024, 164 in 2025, 132 in 2026) as rentable hardware gets faster, so today's "safe" is tomorrow's "maybe." Third, and most important, none of it helps if your password is reused, contains dictionary words, or has appeared in a past breach. Attackers try those first, and they fall in seconds regardless of length.
These figures assume an offline attack on a stolen hash, which is exactly the scenario that matters most. They also assume a randomly generated password. Human-chosen passwords are far more predictable, and far faster to crack.
A real-world example
The 2012 LinkedIn breach is a textbook case. Attackers made off with around 117 million password hashes, and because those hashes used unsalted SHA-1 (a fast, weak-by-modern-standards scheme), huge numbers of them were cracked offline and later traded and sold. Users who had reused their LinkedIn password elsewhere then faced reverse brute force and credential-stuffing attacks against their other accounts. It's the whole chain in one incident: a breach hands over the hashes, weak hashing makes offline cracking cheap, and password reuse turns one leak into many compromised accounts.
What do attackers gain from brute force attacks?
Brute forcing isn't free. Attackers either own serious computing power, rent it, or spend years building a botnet. The payoff comes in several forms:
- Profiting from ads or harvesting activity data
- Stealing personal data and financial assets
- Spreading malware
- Hijacking systems for further attacks
- Damaging a website's reputation
How to reduce your risk of brute force attacks
Defenses fall into two buckets: what individuals should do to protect their own accounts, and what admins should configure to protect a system full of users. You need both.
Protect yourself (for individuals)
Go long before complex. Length is the single biggest factor in how hard a password is to crack, more than adding symbol types. This reflects current NIST SP 800-63B guidance, which prioritizes length, allows long passphrases, and actually discourages forced periodic password changes (they push people toward predictable patterns like Spring2026!). Aim well past 12 characters.
Use passphrases. A long string of random words is easy to remember and hard to crack. Learn what makes a strong passphrase and use one for anything you have to type by hand, like your master password.
Never reuse a password. One breach shouldn't compromise your other accounts. Never reuse credentials, especially for email, banking, or anything sensitive. If your gaming login and your bank share a password, one leak can drain the other.
Avoid common passwords. Anything on a "worst passwords" list ("password," "123456," "qwerty") is the first thing a dictionary attack tries.
Turn on multi-factor authentication. Even a cracked password isn't enough if a second factor is required. If you're weighing options, here's the difference between 2FA and MFA.
Use a password manager. It generates long random passwords, stores them so you don't have to remember them, and ensures one compromised login can't sink the rest.
Protect your network (for admins)
If you're responsible for other people's logins, server-side controls are what actually stop online brute forcing:
- Rate limiting slows repeated login attempts to a crawl.
- Account lockouts temporarily freeze an account after several failed attempts (balanced so attackers can't weaponize it to lock out real users).
- CAPTCHAs block automated login scripts.
- IP throttling and geofencing limit or flag traffic from suspicious sources.
- Monitoring and alerting surface spikes in failed logins so you can respond before an account falls.
- Strong hashing (bcrypt, scrypt, Argon2, or PBKDF2 with a high work factor and salting) makes any hashes that do get stolen far slower to crack offline.
- Enforced MFA across every account raises the floor for the whole organization.
Frequently asked questions
How long does a brute force attack take?
It depends on password length, complexity, randomness, and the hashing algorithm. Per Hive Systems' 2026 data, a random 8-character password with a full character mix takes roughly 132 years to crack offline against bcrypt, while a reused or dictionary-based password can fall in seconds. Fast, unsalted hashes like MD5 shorten those times dramatically.
What's the difference between a brute force attack and a dictionary attack?
A simple brute force attack tries every possible character combination in sequence. A dictionary attack only tries a curated list of likely passwords (common choices and words from past breaches), which is far faster because most people pick predictable passwords. A hybrid attack blends the two.
Are brute force attacks illegal?
Yes. Attempting to access accounts or systems you're not authorized to use is illegal in most jurisdictions, including under laws like the U.S. Computer Fraud and Abuse Act. Security professionals only run these techniques with explicit permission, such as in a sanctioned penetration test.
Does 2FA stop brute force attacks?
Largely, yes, for online attacks. Even if an attacker guesses or cracks your password, multi-factor authentication requires a second factor they don't have. It's one of the most effective single defenses you can enable, though it doesn't replace a strong, unique password.
How do I know if I'm being brute forced?
For an individual, watch for a surge of failed-login or password-reset alerts you didn't trigger. For admins, monitoring should flag spikes in failed authentication, attempts across many accounts from one IP, or logins from unexpected locations.
Protect your team from brute force attacks with TeamPassword
Strong, unique passwords on every account are the foundation, and TeamPassword makes that the default for your whole team. It generates and shares strong credentials so no one is tempted to reuse a weak one, building a culture of good password hygiene that shrinks your brute force risk.
- Built-in password generator creates long, random passwords (12–32 characters) for every account.
- Enforceable 2FA adds a second layer across your organization, blocking access even if a password is compromised.
- AES-256 vault encryption keeps stored credentials protected to the industry standard.
- Activity logs show who accessed which passwords and when, for real accountability.
Plans start at just $2.41 per user per month. Sign up for a 14-day free trial and lock down your team's credentials today. →
