bruteforcing

Brute-forcing, in information security, is a method of attempting to gain access by systematically trying a large number of possible credentials until the correct one is found. It is a form of exhaustive search and can target passwords, PINs, cryptographic keys, or other secret values. The term is often used to describe automated attempts that run through many guesses in sequence.

Variants include pure brute-force attacks that try all combinations and dictionary attacks that test words from a list, sometimes with common substitutions (hybrid attacks). The feasibility of brute-forcing depends on password length, complexity, and whether defenses slow or block attempts. Passwords with high entropy, long length, and unique characters increase the work factor, while password reuse or common words reduce it. Systems may employ rate limiting, account lockout, captchas, or multi-factor authentication to mitigate brute-forcing. Server-side protections such as salted hashing with slow algorithms increase the time required to verify guesses and impede offline brute-forcing of captured password hashes.

Legitimate use includes authorized security testing, where consent is provided and scope defined. Unauthorized brute-forcing is illegal in most jurisdictions and considered a form of access breach. Good security practices include using multi-factor authentication, encouraging long passphrases, using password managers, and monitoring for unusual login activity.