Brute force: guessing a password through repeated attempts
A brute-force attack automatically tests a large number of possible combinations until it finds the right password or key. Its variant, the dictionary attack, prioritizes common or previously compromised passwords.
Definition
The computing power available today makes it possible to test millions of combinations per second against a short or low-complexity password. The longer and more varied a password is, the more the time required to exhaust it by brute force grows exponentially.
Faced with this risk, password length matters more than complexity alone, and additional measures — limiting the number of attempts, progressive delays, multi-factor authentication — make a brute-force attack impractical in real-world conditions.
Key points
A systematic test of combinations
The attack automatically tries many possibilities until it finds the right one.
The dictionary variant
Rather than all possible combinations, the attack prioritizes passwords that are already known or commonly used.
Length, your best ally
A long password makes a brute-force attack impractical, even with substantial computing power.
How BCIT can support you
Our recommendations regarding password storage andmulti-factor authentication directly address this risk.
Frequently asked questions ❓
Is a complex password enough to protect against it?
Length matters more than complexity alone: a long password remains practical to remember while offering much stronger resistance to brute force.
How can an ongoing brute-force attack be blocked?
Limiting the number of attempts, adding a progressive delay between attempts, and using MFA make a brute-force attack impractical in practice.
Not ready to talk yet? Discover our cybersecurity assessment →
Would your accounts withstand a brute-force attack?
Let's assess the robustness of your password and authentication policies.
Brute force: guessing a password through repeated attempts
A brute-force attack automatically tests a large number of possible combinations until it finds the right password or key. Its variant, the dictionary attack, prioritizes common or previously compromised passwords.
Definition
The computing power available today makes it possible to test millions of combinations per second against a short or low-complexity password. The longer and more varied a password is, the more the time required to exhaust it by brute force grows exponentially.
Faced with this risk, password length matters more than complexity alone, and additional measures — limiting the number of attempts, progressive delays, multi-factor authentication — make a brute-force attack impractical in real-world conditions.
Key points
A systematic test of combinations
The attack automatically tries many possibilities until it finds the right one.
The dictionary variant
Rather than all possible combinations, the attack prioritizes passwords that are already known or commonly used.
Length, your best ally
A long password makes a brute-force attack impractical, even with substantial computing power.
How BCIT can support you
Our recommendations regarding password storage andmulti-factor authentication directly address this risk.
Frequently asked questions ❓
Is a complex password enough to protect against it?
Length matters more than complexity alone: a long password remains practical to remember while offering much stronger resistance to brute force.
How can an ongoing brute-force attack be blocked?
Limiting the number of attempts, adding a progressive delay between attempts, and using MFA make a brute-force attack impractical in practice.
Not ready to talk yet? Discover our cybersecurity assessment →
Would your accounts withstand a brute-force attack?
Let's assess the robustness of your password and authentication policies.