Security essentialsBeginner

Brute-force attacks

Try candidates until a valid secret or answer is found.

3 min readUpdated 12 Oct 20267 connections

The idea

Brute force searches a set of possibilities rather than relying on a clever shortcut. Against accounts, rate limits, monitoring, and authentication design influence whether repeated attempts are practical. Against a stolen password verifier, an attacker may test guesses offline without contacting the service. Password length, unpredictability, and suitable password hashing matter in that case. The feasibility of exhaustive cryptographic key search depends on the key space and attacker resources.

In practice

An attacker tests common passwords against a stolen password database. The service’s online lockout policy cannot directly stop those offline guesses.

A common misunderstanding

A fast general-purpose hash is not automatically a suitable password-storage function. Password hashing is designed to make guessing more expensive.

Check your understanding

Why do online and offline guessing require different defenses?

Think it through: Offline guessing bypasses the application’s request controls, so the stored verifier’s design becomes especially important.

Count the guesses an attacker can actually make

A fictional membership service faces repeated password attempts. Online guesses pass through the service, so rate limits, authentication design, monitoring, and account recovery behavior affect feasibility. If password verifiers are stolen, guesses can happen elsewhere without sending requests to the service. The same password can therefore face very different testing conditions.

The candidate set matters as much as the nominal character space. People often choose predictable words or patterns, so an attacker need not enumerate every possible string in order. A password's apparent complexity does not guarantee unpredictability. Password managers and supported authentication alternatives can help users avoid relying on memorable patterns.

Stored verifiers need a password-specific design. A fast general hash allows many candidate checks, while a suitable password-hashing scheme deliberately makes each check more costly under its parameters. Unique salts also prevent treating identical passwords as identical stored records under the intended scheme. These controls do not make weak passwords impossible to guess, but change the economics.

Compare two defensive plans

For a paper exercise, describe an online login endpoint and a stolen dummy verifier dataset. Identify which defenses still apply in each case. Explain why an account lockout cannot directly limit offline computation and why password hashing does not replace online abuse controls.

Use synthetic passwords only in an isolated learning environment. When reporting a real exposure, avoid testing real users' credentials against unrelated services. A useful assessment states the attack conditions and prioritizes improvements to storage, authentication, monitoring, and recovery as appropriate. The goal is to make unauthorized guessing impractical while keeping legitimate users able to regain access safely.