A brute force attack is a method of guessing credentials (usually passwords) by systematically trying many possible combinations until the correct one is found, typically automated with software that can attempt thousands of guesses rapidly. It’s one of the oldest attack techniques, and while basic brute forcing is often thwarted by simple defenses, its variants remain a real threat.

The attack’s logic is simple: if you can try enough combinations, you’ll eventually hit the right one. Its effectiveness depends on password strength, how many guesses the system allows, and how the attacker works around defenses.

Variants of brute force attacks

• Simple brute force: trying all possible combinations, feasible only against short or weak passwords.
• Dictionary attacks: trying lists of common passwords and words, far more efficient than exhaustive guessing.
• Credential stuffing: technically a form of brute forcing using known leaked username/password pairs (covered separately, as it exploits reuse rather than guessing).
• Password spraying: trying a few common passwords across many accounts to avoid lockouts (also covered separately).
• Reverse brute force: starting from a common password and trying it against many usernames.

Why basic brute force often fails: and where it still works

Straightforward brute forcing is easily blunted by rate limiting, account lockouts after failed attempts, and CAPTCHAs. But attackers adapt: they distribute attempts across many IPs (via proxies) to dodge rate limits, use dictionary and spraying techniques to reduce guesses, and target offline password hashes stolen in breaches, where they can guess at will without triggering online defenses. So while "brute force" sounds crude, its smarter variants remain effective, especially against weak passwords and leaked hashes.

How to defend against brute force

Layered defenses work: enforce strong password policies (or eliminate passwords entirely), apply rate limiting and progressive lockouts, use CAPTCHA or bot detection to stop automation, and add MFA so a guessed password isn’t enough. For stored credentials, strong hashing (with salting) makes offline brute forcing far harder. The most decisive defense, as with most credential attacks, is going passwordless. You can’t brute-force a password that doesn’t exist.

Frequently asked questions

What is a brute force attack?

Systematically guessing credentials by trying many combinations, usually automated, until the correct one is found.

What are the types of brute force attacks?

Simple brute force, dictionary attacks, credential stuffing, password spraying, and reverse brute force.

How do you stop brute force attacks?

Rate limiting, lockouts, CAPTCHA/bot detection, MFA, strong hashing of stored credentials, and, most decisively, going passwordless.

Related: Password Spraying · Credential Stuffing · Bot Detection · Multi-Factor Authentication (MFA) · Passwordless Authentication