Brute Force Attack (BFA)

A brute force attack (BFA) is a method of gaining unauthorised access by trying possible passwords, PINs or encryption keys one after another until the correct one is found. Instead of exploiting a software flaw, the attacker relies on computing power and persistence. Simple versions guess every combination of characters; more efficient versions use lists of common or leaked passwords. Brute force is one of the oldest techniques in hacking and remains common against online logins, wireless networks and stolen password databases.

The threat is central to how financial institutions and crypto systems are secured. Banks limit login attempts and require multi-factor authentication, while blockchains rely on keys so long that brute force is practically impossible. The risk becomes real when people choose weak passwords, reuse passwords across sites or protect wallets with short PINs or guessable phrases. Brute force is closely related to credential stuffing and dictionary attacks, and it is one of the tools of the black hat hacker.

Imagine a padlock with three dials, each numbered 0 to 9. There are only 1,000 possible combinations, so a patient thief could try them all in an afternoon. Add a fourth dial and there are 10,000 combinations; add a dozen dials with letters too, and trying them all would take longer than a lifetime.

A brute force attack is the thief trying every combination, but with a computer doing billions of guesses. Short or common passwords fall quickly. Long, random passwords and cryptographic keys have so many possibilities that even the fastest computers cannot get through them, which is why length and randomness matter more than clever tricks.

• Simple brute force. Every possible combination of characters is tried, starting with short ones.
• Dictionary attacks. Attackers try words, names and common passwords such as "password123" first.
• Credential stuffing. Username and password pairs leaked in a data breach are tried on other sites, exploiting password reuse.
• Password spraying. A few common passwords are tried across many accounts to avoid lockouts.
• Offline cracking. If attackers steal a database of hashed passwords, they can guess at full speed on their own hardware, often using graphics processors; salting and slow hashing make this much harder.
• Reverse brute force. One known password is tried against many usernames.

The number of possible keys grows exponentially with length. For a password of length $L$ drawn from $N$ possible characters, the number of combinations is:

An 8-character password using only lowercase letters has $26^{8} \approx 2.1 \times 10^{11}$ possibilities, which modern cracking hardware can exhaust quickly if the hash is fast. A 12-character password using upper and lower case, digits and symbols, about 94 characters, has $94^{12} \approx 4.8 \times 10^{23}$ possibilities. A Bitcoin private key has about $2^{256}$, roughly $1.2 \times 10^{77}$, possible values, a number so large that guessing a particular key by brute force is not feasible with any foreseeable technology. A 12-word recovery phrase from the standard 2,048-word list carries 128 bits of randomness, also far beyond brute force.

Online banking, card systems and payment apps face constant automated login attempts. Card PINs are protected by blocking the card after a few wrong tries. Fraudsters also brute-force card details, cycling through card numbers, expiry dates and security codes on online shops, a pattern known as card testing fraud. In crypto, the blockchain's keys are effectively immune, but weak points include exchange accounts with reused passwords, wallet files encrypted with short passwords, and "brain wallets" generated from memorable phrases, many of which have been emptied by attackers who guessed common phrases. Hardware wallets typically wipe themselves after a number of incorrect PIN entries to defeat physical brute force.

Organisations defend against brute force with:

• Limits on failed login attempts, delays between attempts and temporary lockouts.
• Multi-factor authentication, so a password alone is not enough; see two-factor authentication.
• Detection of unusual login patterns, such as many attempts from one address or logins from new devices, often using device fingerprinting.
• Storing passwords with slow, salted hashing algorithms designed to resist cracking.
• CAPTCHAs and bot detection to slow automated tools.

Individuals can protect themselves by using long, unique passwords, ideally stored in a password manager, enabling app-based or hardware authentication rather than SMS codes where possible, and never reusing exchange or banking passwords. Crypto holders should generate keys and recovery phrases with proper wallet software rather than choosing their own words. Researchers continue to study whether future quantum computers could weaken some cryptographic systems; current guidance focuses on migrating to quantum-resistant algorithms over time rather than on any present threat to well-designed keys.