A brute force attack tries many guesses against a secret such as a password or a key until one attempt succeeds or the guessing stops.
It creates candidates as it goes, which differs from replaying username and password pairs that were already stolen from somewhere else.
How it works
The practical limit is cost: short secrets and missing delays make huge numbers of guesses cheap, while long secrets and extra checks make them uneconomic.
Online guessing hits a live service, and offline guessing attacks a stolen file of scrambled secrets without showing each try to the user.
People sometimes picture only password forms, yet the same idea applies to recovery codes, keys, and other short secrets.
Defenses should cover every place a guess can be checked, including forgotten password flows that are quieter than the main login page.
Concrete examples
- A login page receives thousands of password guesses for one executive account over a single night.
- A stolen file of scrambled passwords is tested on another machine until a short secret becomes readable.
- Recovery codes made of only a few digits are exhausted because the space of possible values is small.
Protective measures
- Require long unique secrets and a second factor on mail, remote access, and any system that can move money.
- Slow or temporarily hold repeated failures on the same account and on the same source without locking out an entire city.
- Watch password reset and recovery paths with the same care as the main login, because guessers look for the quieter door.
- Store passwords only in a strong scrambled form so a copied file is not a ready list of secrets.
How CDPCaptcha helps
Browser proof of work forces every automated guess to consume extra computation, which raises the cost of trying large numbers of secrets.
CDPCaptcha is a self-hosted proof of work check in the browser, with no cookies, no tracking, and no picture puzzles.
It is made and hosted in the EU, in Germany, and the service is described at https://cdpcaptcha.com/.
Related articles
The article What is credential stuffing? explains replay of already stolen pairs, which is not the same as generating guesses.
The article What is authentication in security? describes the check that both guessing and stolen pairs try to satisfy.
The article What is a captcha bot? covers scripts that try to keep guessing after a human test appears.