Glossary · simply explained

Brute force attack

Brute force tries passwords systematically — from simple wordlists to distributed guessing against thousands of accounts.

A brute force attack tries to guess credentials by systematic trial: all combinations (classic), wordlists with typical passwords (dictionary), or conversely one common password against many accounts (password spraying) — the variant that elegantly bypasses lockouts.

Targets are everything with a login: VPN portals, email, RDP and SSH access, admin panels, APIs. Exposed remote access traditionally sits at the top of the list.

The variants at a glance

Classic exhaustive guessing fails against good passwords and lockouts — it stays relevant offline, when attackers crack stolen password hashes with GPU power. Online, the clever variants dominate: dictionary attacks with realistic wordlists and password spraying, which stays below any lockout threshold with few attempts per account.

Defence combines enlarging the search space (long passphrases, better passkeys), slowing down (rate limits, progressive delays, lockouts) and detecting distributed patterns across accounts — plus the ground rule of never exposing remote access unprotected.

Protections that work

MFA or passkeys: a guessed password alone opens nothing.
Rate limits and progressive delays on all login endpoints.
Detect password spraying: correlate failures across accounts.
Exposed access (RDP, SSH, admin panels) behind ZTNA instead of open on the internet.

Frequently asked questions about Brute force attack

What is password spraying?

Brute force in reverse: instead of testing many passwords against one account, the attacker tries one common password against many accounts — staying below every lockout threshold. Detectable only by correlating failures across accounts.

Does an account lockout after failed attempts protect?

Against classic guessing yes, against spraying barely — there are only a few attempts per account there. Lockouts can also be abused as a weapon to lock users out. Progressive delays, bot detection and MFA work better.

How long does a secure password need to be?

Length beats complexity: passphrases from about twelve to sixteen characters made of several words are practically impossible to guess online and expensive to crack offline. Better still: unique passwords from a password manager — or passkeys right away.

What does offline brute force mean?

Attackers obtain password hashes (from a database leak, say) and crack them on their own hardware — without rate limits, at GPU speed. Modern, slow hashing schemes and long passphrases help; for operators: protect hashes like crown jewels.

Why are RDP and VPN access favourite targets?

Because they promise direct full access and often sit openly on the internet. Constant bombardment of exposed remote access is internet background noise. The sustainable answer: put such access behind Zero Trust access (ZTNA) instead of leaving it publicly reachable.