Brute Force — is the automated guessing of a password or other data by systematically trying different combinations. A special program checks one option after another until it finds the correct one.
For example, if an attacker wants to gain access to an account but does not know the password, they can run a program that checks different combinations: 123456, 123457, 123458, and so on, until it finds the correct one.
How Brute Force Works
In the classic version, the program tries all possible combinations within a specified range. If the password consists only of numbers, there will be fewer possible combinations. If it contains uppercase and lowercase letters, numbers, and special characters, the number of combinations increases sharply.
Therefore, a simple short password is much easier to guess than a long and complex one.
The person does not manually try anything. They set the parameters for the program, and it then automatically performs a large number of attempts.
What Types Exist
-
Full brute force — the program checks all possible combinations until it finds the correct one.
-
Dictionary attack — instead of trying all combinations, ready-made lists of common passwords and words are used. For example, the program first checks popular options such as qwerty, password, names, and other commonly used combinations.
-
Attack using leaked databases — in this case, the password is no longer guessed. Login + password pairs that were previously exposed online due to data leaks are used and tested on other services.
What Affects the Success of Brute Force
The main factor — is password complexity and length. The more possible combinations there are, the more time it will take to check them.
But much also depends on the protection of the service itself. If the system temporarily blocks login after several failed attempts, introduces CAPTCHA, or requires additional verification, carrying out large-scale brute-force attempts becomes much more difficult.
Two-factor authentication (2FA) also protects the account even when the password has already become known to an attacker: the password alone will not be enough to log in.
Where Brute Force Is Used
Brute force is used not only for account passwords. Depending on the situation, this method may also be used to try to guess:
-
PIN codes;
-
encryption keys;
-
access codes;
-
session tokens or one-time verification codes.
At the same time, the method itself is not something that exists only for hacking. Brute force as a technical method can also be used legally, for example by security specialists when testing their own systems.
Important: brute force is legal only when testing the security of your own services. Attempting to guess the password to someone else’s account or hack someone else’s system — is a direct violation of the law.
