Brute-Force Attack: How to Effectively Protect Your Passwords

Learn what a brute-force attack is, how it works, and what measures you can take to effectively protect your passwords and accounts.

Reading time:

9 min

Share

Passwords protect access to email accounts, cloud services, corporate networks, and numerous other digital systems. Various attack methods are used to compromise passwords. One of the best-known is the brute-force attack. In this method, possible passwords are systematically tested until the correct combination is found.

In practice, however, brute-force attacks vary significantly from one another. In this blog post, we’ll explain what a brute-force attack is, what types exist, why some attack methods are significantly more successful than others, and what measures users and operators can take to protect themselves effectively.

What is a brute-force attack?

In computer science, the term “brute force” refers to a general method for solving a problem. It involves systematically searching the entire space of possible solutions until the correct one is found. Instead of relying on probabilities or prior knowledge, all potential options are tested one by one.

A brute-force attack on passwords is a specific application of this principle. The goal is to discover the correct password by automatically testing various password candidates. The success of such an attack depends on factors such as password length, the password’s unpredictability, and the security mechanisms in place.

A simple example is a four-digit combination lock. Since each digit position has ten possible values, there are a total of 10,000 combinations ranging from 0000 to 9999. An attacker could try these combinations sequentially until the lock opens. In the worst-case scenario, all 10,000 combinations would need to be tested, though the correct combination is often found much sooner.

Brute-force attacks on passwords operate on the same principle. The difference is that the attempts are not performed manually but are carried out automatically by software.

How does a brute-force attack work?

How a brute-force attack unfolds depends crucially on where passwords are verified. A fundamental distinction is made between online brute-force attacks and offline password cracking.

Online Brute-Force

In an online brute-force attack, the attacker repeatedly sends login attempts to a login service—such as a web application, VPN, or SSH server. A different password is tested for each attempt until a successful login occurs or the attack is aborted.

Since the target system must process each login attempt, operators can often detect and mitigate such attacks. Protective mechanisms—such as rate limiting, progressive delays, temporary account lockouts, or multi-factor authentication—significantly hinder automated login attempts.

One example of a tool that supports automated login attempts against various network services is Medusa. Such tools are used to automate login attempts against protocols like SSH, FTP, or SMB and to test the validity of credentials.

Offline Password Cracking

Offline password cracking is often significantly more dangerous. It requires the attacker to have already gained access to a database of stored password hashes—for example, following a data breach.

In this scenario, there is no need to send requests to the actual system. Instead, the attacker generates password candidates locally, calculates their hashes using the same algorithm, and compares the result with the compromised password hash. If the hashes match, the original password has been discovered.

Since this process takes place entirely on the attacker’s own hardware, protective measures such as rate limiting or account lockouts are ineffective. The actual speed of such an attack depends on factors including the password hashing algorithm used, its configuration parameters, and the available hardware.

A well-known tool for this type of attack is John the Ripper. The program supports numerous password hashing algorithms and is used to analyze password hashes offline and test their resilience against various attack methods.

What types of brute-force attacks are there?

Not every password attack follows the same pattern. In practice, attackers rarely attempt to exhaustively try every possible combination of characters. Instead, they often leverage their knowledge of how people create passwords. This allows them to significantly increase both the speed of an attack and the likelihood of success.

Classic Brute-Force Attack

In a classic brute-force attack, possible password combinations are systematically tested until the correct password is found. Initially, no assumptions are made regarding the password’s structure; instead, the potential character space is searched step by step.

The longer the password and the larger the set of characters used, the greater the search space—and consequently, the effort required for a successful attack. For this reason, long, randomly generated passwords are considered significantly more resistant to classic brute-force attacks than short or easily predictable ones.

Dictionary attack

A dictionary attack takes a different approach. Instead of testing every possible combination of characters, the attacker uses a list of commonly used passwords and terms. Such dictionaries contain, for example, words from various languages, names, keyboard patterns, sequences of numbers, or passwords known from previous data breaches.

In practice, this attack method is often significantly more successful than a classic brute-force attack. The reason for this is that many people do not choose random passwords but instead use easily memorable terms or familiar patterns. Consequently, passwords such as “Summer,” “Password,” or a pet’s name can often be discovered with relatively few attempts.

Hybrid Brute-Force Attack

A hybrid attack combines a dictionary attack with rule-based extensions. Starting with a base word, variants are automatically generated—for instance, by appending years, sequences of numbers, or special characters, or by substituting individual letters.

For example, the password “Sommer” might yield variants such as “Sommer2025”, “Sommer!”, “S0mmer”, or “Sommer123”. Since many users create passwords based on similar patterns, such rule-based attacks are often far more efficient than exhaustively searching through every possible combination.

Reverse Brute-Force Attack

In a reverse brute-force attack, the attacker takes the opposite approach. Instead of trying many passwords against a single user account, a known password is tested against numerous user accounts.

Such a scenario can arise, for example, following a data breach where a commonly used password has been exposed, or in organizations where default passwords have been employed. The goal is to identify user accounts that use this password.

How can brute-force attacks be prevented?

As with all types of cyberattacks, it is not possible to achieve complete protection against brute-force attacks. However, the risk can be significantly reduced through appropriate technical and organizational measures. These protective measures vary depending on whether they are implemented by users or by service providers.

Protective Measures for Users

We recommend that users first get an overview of whether they have been affected by a data leak. If a user’s login credentials have been leaked, an attacker doesn’t even need to use a brute-force attack to gain access to a user account. For this purpose, we recommend the Identeco Leak Inspector. The Leak Inspector provides end users with a comprehensive overview of their own data breach status—free of charge and in compliance with data protection regulations. You can learn more about the Leak Inspector here.

In addition to this basic security measure, there are a few other simple tricks you can use to improve your password security.

Translated with DeepL.com (free version)

Protective Measures for Platform Operators

As a platform operator, you have a particular interest in protecting your customer accounts from unwanted account takeover attacks. Active protection of customer accounts is possible, for example, by simply comparing user data with the Identeco Leak database. This makes it easy to protect your platform against brute-force attacks. In this blog post, you can learn more about platform protection with Identeco.

In addition to this basic security measure, there are several other steps platform operators can take to enhance platform security:

Conclusion

Brute-force attacks are among the oldest and best-known methods for attacking passwords. In practice, however, they have long since evolved beyond simply attempting every possible combination of characters. Dictionary attacks, hybrid attacks, and password spraying specifically exploit the tendency of users to choose predictable or reused passwords, often making them far more efficient than classic brute-force attacks.

Distinguishing between online brute-force attacks and offline password cracking is equally important. While online attacks can be mitigated by protective measures such as rate limiting or multi-factor authentication, security following a data breach depends heavily on secure password storage using modern hashing algorithms like Argon2.

TThe most effective defense, therefore, consists of several complementary measures. Users should use long, unique passwords, manage them in a password manager, and enable multi-factor authentication. Operators, on the other hand, should also secure their applications against automated login attempts using appropriate protective measures and, in line with the current state of the art, ensure that their users do not use compromised credentials—for example, by using Identeco products.

To learn more about the topics addressed, click here:

• 2FA and MFA
• Choose a password correctly

If you have any further questions about data security, account security or Identeco’s services, please contact us at email or make an appointment with us here!