Brute force attack
Systematically trying password combinations until the right one is found. Its viability depends on password length and attempt limits.
Full definition
A brute force attack systematically tries password combinations until it finds the right one. In its simplest version it walks through every possible combination; the dictionary version tries frequent words and patterns first, which is where most human passwords fall.
Its viability depends on two factors: password length and complexity, which increases computation time exponentially, and the attempt limits of the targeted system. Against an online service with lockouts, pure brute force is slow; against a file or a hash stolen in a breach, an attacker can try billions of combinations per second with ordinary hardware.
Long passwords, password managers that generate unique keys, and multi-factor authentication turn brute force into an attack of diminishing returns.
Related terms
Password spraying
An attack that tries a few common passwords against many accounts, instead of many passwords against one. That way it avoids lockouts.
Credential stuffing
Automated testing of credentials stolen from one service against many others. It works because people reuse passwords.
Multi-factor authentication (MFA)
Identity verification with two or more independent factors. It makes a stolen password insufficient, though not invulnerable.
From definition to data: measure your company's human risk
Fensivo detects leaked credentials, simulates real attacks and validates with retests that behavior changed.