Brute-force attack
brute force · password spraying · dictionary attack · password guessing · password cracking · attaque par force brute
An attack that systematically tries large numbers of passwords until it finds the right one, either online against a login service or offline against stolen password hashes.
In practice
The naive version tries thousands of passwords on a single account and soon triggers a lockout. Password spraying does the opposite: a handful of very common passwords, such as “Summer2026!”, tried slowly across hundreds of accounts to avoid lockouts. Offline, a stolen database of hashes falls faster when the hashing is fast or unsalted. Long passwords and multi-factor authentication make these attacks largely ineffective.
In October 2024, CISA, the FBI and partner agencies warned that Iranian actors had, since October 2023, been combining password spraying with floods of multi-factor push notifications against healthcare, energy and government organisations, probably to sell on the access they gained.
How to protect yourself
- Phishing-resistant multi-factor authentication on all internet-facing access; never approve a prompt you did not trigger.
- Long passphrases and a ban on common passwords.
- Progressive lockouts and alerts on failed logins spread across several accounts.
- Store passwords with a slow, salted hash (Argon2, bcrypt).
