# What is a brute force attack?

> An attack that tries every possible combination until it finds the correct password or key.

Last reviewed: 2026-09-01

## Brute force attack

Category: Attacks

Canonical page: https://moolkey.com/glossary/brute-force-attack

A brute force attack tries every possible password in sequence until one works. Its cost grows exponentially with password length, which is why length matters more than any composition rule. In practice, attackers rarely brute force blindly. They exhaust likely candidates first, then fall back to exhaustive search.

### Online versus offline

An online attack runs against a live login form, where rate limiting and lockouts cap the attacker at perhaps 100 attempts per second. An offline attack runs against a stolen database on the attacker's own hardware, where a GPU cluster reaches 100 billion attempts per second against a fast hash. Always assume the offline case when judging a password.

### Why length beats complexity

Adding one character multiplies the search space by the entire pool size, roughly 86 times for a mixed-character password. Adding a symbol type only widens that pool once. A 16-character random password from an 86-character pool exceeds 100 bits and sits outside practical brute-force reach under current assumptions.

### Sources

- [OWASP: Credential Stuffing Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html): How password reuse is replayed at scale and how services can limit the damage.
- [CISA: Secure Our World](https://www.cisa.gov/secure-our-world): Public guidance for recognizing phishing and protecting high-value accounts.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.