---
title: "Brute force"
description: "A brute force attack cracks passwords by trying combinations until one works. Learn the attack variants and how to protect servers and login forms."
url: "https://nodea.io/en/glossary/brute-force-attack"
lang: "en"
updated: "2026-07-13"
---

# Brute force

> A brute force attack is an attempt to break authentication by systematically trying passwords, keys or codes until one succeeds — powered by nothing more than computing time.

A **brute force attack** is a method of breaking authentication by systematically trying candidate passwords, keys or PINs until one works. It exploits no software vulnerability at all — its only ingredients are computing power and time, which makes it both primitive and remarkably persistent: any login endpoint reachable from the internet will be probed, usually within hours of going online.

## How brute force attacks work

Several variants dominate real-world traffic:

- **exhaustive brute force** — trying every character combination; only feasible against short [passwords](https://nodea.io/en/glossary/password),
- **dictionary attacks** — wordlists of common passwords and mutations ("Summer2024!") tried first, drastically cutting search time,
- **credential stuffing** — login/password pairs leaked from other services replayed everywhere, exploiting password reuse,
- **password spraying** — one popular password tried across thousands of accounts, deliberately staying under per-account lockout thresholds,
- **offline cracking** — stolen password hashes attacked on GPU rigs at billions of guesses per second, with no rate limits to slow anyone down.

Favorite targets include WordPress and hosting-panel logins, [SSH](https://nodea.io/en/glossary/ssh) and FTP services, mailbox accounts and APIs. Modern campaigns run through botnets spanning thousands of IP addresses, so blocking a single source achieves little.

## Practical defense

Effective protection stacks several layers. On the account side: long, unique passwords stored in a password manager, and [two-factor authentication](https://nodea.io/en/glossary/two-factor-authentication), which turns a guessed password into a dead end. On the server side: rate limiting and automatic IP bans driven by log analysis ([Fail2ban](https://nodea.io/en/glossary/fail2ban) is the classic tool), CAPTCHA after repeated failures, SSH restricted to key-based authentication, root login disabled, and — where possible — admin panels hidden behind a VPN or IP allowlist. VPS administrators often move SSH off port 22 as well; it stops no determined attacker but filters out mass scanners and keeps logs readable.

Finally, watch your authentication logs: a sudden spike in failed logins is usually the first sign of an active campaign and the right moment to tighten firewall rules.

### How do I protect a server against brute force attacks?

Layer the defenses: key-based SSH login instead of passwords, automatic IP banning after failed attempts (e.g. Fail2ban), two-factor authentication, disabled root login, and rate limiting plus CAPTCHA on web login forms. Monitoring auth logs catches campaigns early.

## Related

- [Password](https://nodea.io/en/glossary/password)
- [Two-Factor Authentication (2FA)](https://nodea.io/en/glossary/two-factor-authentication)
- [Fail2ban](https://nodea.io/en/glossary/fail2ban)
- [CAPTCHA](https://nodea.io/en/glossary/captcha)
- [Firewall](https://nodea.io/en/glossary/firewall)

---

Languages: [pl](https://nodea.pl/pl/slownik-pojec/brute-force.md)  
Site index: [llms.txt](https://nodea.io/en/llms.txt)