Brute-force Attacks

A brute-force attack uses software to try many possible passwords until the correct one is found, so the attacker can gain unauthorised access to an account, device or network.

The software does the work, not a person. It can try a million combinations every second, working through every arrangement of letters, digits and symbols, or running through a list of common passwords such as qwerty or a favourite football club. A person typing guesses by hand could try only a few each minute; the software keeps going without tiring. The "brute force" in the name is this willingness to try every option rather than being clever about it.

Why length and variety matter

Every extra character multiplies the number of combinations the software must work through, and mixing upper case, lower case, digits and symbols widens the choices at each position. A short, simple password can fall in seconds; a long, mixed one would take so long that the attacker gives up and looks for an easier target.

So a password that is both long and varied is not uncrackable, just far too slow to be worth the attacker's time.

What the attacker is after

The aim is unauthorised access, not damage. Nothing is broken; the attacker simply becomes a logged-in user. From there they can read, change or steal whatever the account can reach, such as emails, homework files or photos, or use it as a way into other systems. Because they sign in with a real password, their activity can look like a normal user's, which is what makes the attack so useful to them.