What is a brute force attack?
A brute force attack tries every possible password in sequence until one works. Its cost grows exponentially with password length, which is why length matters more than any composition rule. In practice, attackers rarely brute force blindly. They exhaust likely candidates first, then fall back to exhaustive search.
- Topic
- Attacks
- Reading time
- 1 min
- Reviewed
On this page
Online versus offline
An online attack runs against a live login form, where rate limiting and lockouts cap the attacker at perhaps 100 attempts per second. An offline attack runs against a stolen database on the attacker's own hardware, where a GPU cluster reaches 100 billion attempts per second against a fast hash. Always assume the offline case when judging a password.
Why length beats complexity
Adding one character multiplies the search space by the entire pool size, roughly 86 times for a mixed-character password. Adding a symbol type only widens that pool once. A 16-character random password from an 86-character pool exceeds 100 bits and sits outside practical brute-force reach under current assumptions.
Sources
These primary references support the terminology and current security guidance used in this definition.
