What Is a Brute Force Attack?

A brute force attack is an attempt to gain access to an account or system by systematically trying possible passwords or keys until one works. The concept is as old as passwords themselves; what makes it dangerous today is automation. Software can attempt thousands of guesses per second, and distributed infrastructure lets attackers spread those guesses across many machines and IP addresses.

Common Variants

Classic brute force enumerates every possible combination, which is only practical against short or weak passwords. Dictionary attacks narrow the search to likely candidates: common passwords, leaked password lists, and mutations such as appended years or symbol substitutions. Password spraying inverts the approach by trying a few very common passwords across many accounts, staying below per-account lockout thresholds. Reverse brute force starts from a known password and searches for the account it belongs to. Credential stuffing is a related but distinct technique that replays known-good credentials from breaches instead of guessing.

Why Lockouts and Rate Limits Are Not Enough

Account lockout policies and rate limiting are essential baseline defenses, and attackers design around both. Guesses distributed across a botnet or a residential proxy pool arrive from thousands of different IP addresses, so no single source exceeds a limit. Password spraying keeps each account under its lockout threshold by design. Aggressive lockout rules also create a denial-of-service risk of their own, because attackers can deliberately lock out legitimate users.

Warning Signs

Indicators include elevated login failure rates, failed attempts spread across many accounts and source IPs, bursts of authentication traffic at unusual hours, and repeated failures with systematically varied passwords. On APIs, the same pattern appears against token and key endpoints.

How to Prevent Brute Force Attacks

Strong password policies and multi-factor authentication remove the easy wins, and lockouts plus rate limiting remain necessary despite their gaps. What closes the remaining gap is making each guess expensive: verification layers such as CaptchaFox require every login attempt to come from a real browser environment and, when risk signals warrant it, to solve a cryptographic proof-of-work challenge — a cost imperceptible for one legitimate login but ruinous across thousands of guesses, independent of which IP addresses the campaign uses. Legitimate users keep a frictionless login, since challenges only appear for suspicious traffic.