Brute Force
Noun · Adjective · Security & Infosec
Definitions
Brute Force is an attack method that systematically tries every possible combination of a password, encryption key, or other secret value until the correct one is found. The approach requires no clever technique or vulnerability, relying instead on computational power and time. For password cracking, a brute force attack tries every combination of characters up to a given length. Dictionary attacks (a refined form) try words and common patterns first, while hybrid attacks combine dictionary words with mutations (replacing letters with numbers, adding special characters). The effectiveness of brute force depends on the target's complexity and the available computing power: a 4-digit PIN has only 10,000 possibilities, while a 12-character password with mixed case, numbers, and symbols has trillions. Defenses include long, complex passwords, account lockout policies after failed attempts, rate limiting, CAPTCHAs, multi-factor authentication, and using computationally expensive hashing algorithms like bcrypt or Argon2 that make each guess slower. GPU-accelerated cracking tools like Hashcat can test billions of hashes per second against weak algorithms.
In plain English: Trying every possible password one by one until you guess the right one, like trying every key on a keyring.
Example: "With a 6-character password, a brute force attack takes seconds. With 20 characters, it takes longer than the universe has existed."
In algorithms, a brute-force solution checks every possible answer — exhaustive search with no optimization. Often the correct first approach: get it working with brute force, then optimize. 'Make it work, make it right, make it fast.'
Example: 'The brute-force solution checks all 2^n subsets and runs in exponential time. Good enough for n < 20, completely unusable beyond that.'
Source: algorithmic usage
Etymology
- 1790s
- The phrase 'brute force' enters English meaning raw physical strength without skill or subtlety
- 1960s
- Computer scientists adopt it to describe algorithms that try every possible solution, contrasted with clever heuristics
- 1990s
- Brute-force password cracking becomes a standard attack technique; tools like John the Ripper automate the process
Origin Story
The algorithm that tries every possible answer until one works
**Brute force** in computing borrows from the military term for overwhelming force without finesse. As an algorithmic strategy, it means exhaustively trying every possibility. Need to crack a 4-digit PIN? Try all 10,000 combinations.
Brute force is the baseline approach in algorithm design -- it always works (given enough time) but is usually too slow for practical use. The art of computer science is finding algorithms that beat brute force: binary search beats linear scan, hash tables beat sequential lookup.
In security, brute force attacks remain relevant because humans choose predictable passwords. A brute force attack against 'password123' takes milliseconds. Rate limiting, account lockouts, CAPTCHAs, and bcrypt (deliberately slow hashing) are all defenses against brute force's patient, stupid persistence.
Coined by: General computing terminology (military origins)
Context: Early computing era, military metaphor
Fun fact: The 2014 iCloud 'Celebgate' hack used brute force against Apple's Find My iPhone API, which had no rate limiting. The attacker could try unlimited password guesses. Apple added rate limiting immediately after -- a fix that should have been there from the start.