What Is a Brute Force Attack? Types, Math and Defenses

A brute force attack is any attack that guesses a secret (a password, a PIN, an encryption key) over and over until one guess is accepted. There's no exploit involved. The attacker only needs a way to check guesses and enough time, so the whole defense comes down to two numbers: how many guesses the attacker can make per second, and how many guesses your password needs.

Both numbers vary by many orders of magnitude, which is why "is my password safe from brute force" has no single answer.

Five attacks that all get called "brute force"

The textbook version tries aaaa, aaab, aaac and so on through every combination. Almost nobody runs it that way against passwords, because people don't pick passwords uniformly. The variants you'll actually meet:

The first three are mostly offline problems: the attacker has a copy of the password hashes and grinds through guesses on their own GPUs. Spraying and stuffing are online: they go through the real login page, so they're designed to avoid tripping rate limits. Spraying sends one or two guesses per account and moves on, so a per-account lockout never fires. Stuffing needs no guessing at all, because the password is already known from someone else's breach.

That split matters more than the name. A long random password beats the offline variants, and only a unique password beats credential stuffing.

Online guessing is throttled, offline cracking is not

Against a live login form, the server decides how fast the attacker goes. NIST SP 800-63B (Rev. 4) requires services to cap consecutive failed attempts on one account at 100, and most add per-IP limits, delays or CAPTCHAs well before that. At that point even a mediocre password survives pure guessing, which is exactly why online attackers switched to spraying and stuffing.

Offline, there's no server in the way. Once a hash database leaks, the only limit is hardware and the hash function the site chose. Hashcat benchmarks on a single RTX 4090:

Those are hashcat 6.2.6 numbers; attackers rent rigs with eight of these cards. The gap between the first and last row is the reason password storage matters as much as the password. More detail, including scrypt and Argon2id, is in what bcrypt is and why MD5 is dead.

Length beats complexity: the math

For a random password, the attacker's worst-case workload is the size of the search space:

combinations = R ^ L
entropy H    = L × log₂(R)

R = number of possible characters (26 lowercase, 62 alphanumeric, 95 printable ASCII)
L = length

Complexity rules change R. Length changes L, which is the exponent. Starting from an 8-character lowercase password (26⁸, about 2.1 × 10¹¹ combinations):

Adding uppercase, digits and symbols to 8 characters buys a factor of about 31,800. Adding four more characters on top multiplies the result by another 81 million. Character variety still helps, but it's the small lever. For the full table across lengths and hashes, see how long it takes to crack a password.

Why "P@ssw0rd!" falls in seconds anyway

All of that math assumes the password is random. Human passwords aren't, so attackers don't search the full space. They start from wordlists like the 2024 RockYou2024 compilation (close to 10 billion strings from older leaks) and apply rule files: capitalize the first letter, swap a for @ and o for 0, append a year or !. P@ssw0rd! is nine characters with all four character classes, and it sits near the top of every list.

That's the weakness of composition rules. They push people toward predictable patterns (capital first, digits and symbol last), and mask attacks are built for exactly those patterns. A password stops being guessable only when nothing about it is predictable, which in practice means a generator picked it.

Stopping brute force on a login you run

If you build or maintain a login, the defenses map onto the variants above:

1. Rate-limit by account and by source. Per-account limits stop classic guessing, per-IP and per-ASN limits slow spraying. Increasing delays are friendlier than hard lockouts, which let anyone lock a known user out on purpose.
2. Screen new passwords against breach lists. NIST requires a blocklist of common and compromised passwords. The Have I Been Pwned range API lets you check a password by sending only the first five hex characters of its SHA-1 hash.
3. Store passwords with a slow, salted KDF. Argon2id, scrypt or bcrypt at cost 10 or higher, per the OWASP Password Storage Cheat Sheet. This is the only defense that still works after the database leaks. You can try cost factors in the Bcrypt Generator.
4. Offer MFA, ideally passkeys. A correct password from a stuffing list is useless without the second factor.

I'd treat the first two as the minimum for anything with a public login, and the third as non-negotiable.

How long your own password should be

NIST SP 800-63B Rev. 4 sets 15 characters as the minimum when a password is the only factor and 8 when it's paired with MFA. For a randomly generated password, 15 printable characters is about 98 bits, far beyond any offline rig. For anything stored in a password manager, I'd just use 16 to 20 random characters, since you never type them anyway.

The Password Generator builds those from crypto.getRandomValues() rather than Math.random(), whose internal state can be reconstructed from a few outputs. It runs entirely in your browser, so the password never reaches a server. To see how an existing password holds up, paste it into the Password Strength Checker, and treat its crack time as an upper bound if you chose the password yourself.

FAQ

What is a brute force attack?

Systematic guessing of a secret until one guess works. The pure version enumerates every combination, but real attacks against passwords start with leaked passwords and mutation rules and only fall back to exhaustive search for short or random secrets.

Why is password length more important than complexity?

Because the search space is R ^ L. Moving from 26 to 95 possible characters is a one-time multiplier of about 31,800 for an 8-character password. Each extra character multiplies the whole space by 95 again, so four more characters add a factor of about 81 million.

How fast can a GPU brute force a password?

On one RTX 4090, about 164 billion guesses per second against MD5 and about 5,750 against bcrypt at cost 10 (hashcat 6.2.6). That only applies offline, after a hash database leaks. Through a rate-limited login form, an attacker gets a few guesses per second, and NIST caps failed attempts per account at 100.

What is the difference between brute force, password spraying and credential stuffing?

Brute force aims many guesses at one account. Spraying aims one or two common passwords (Winter2026!, Password1) at thousands of accounts so no single account hits its lockout. Credential stuffing replays leaked email and password pairs from other breaches, so it succeeds on the first try against anyone who reused a password.