Brute-Force Attacks

What it is

Brute-force attacks repeatedly test candidate passwords or other secrets until one works. Online guessing targets a sign-in service; offline guessing targets stolen password hashes without contacting that service. Dictionary-based and pattern-based guessing often reduce the work compared with trying every possible combination. The distinction matters because online lockouts cannot slow an attacker's offline computer.

How it works

For online attacks, automated requests submit guesses and observe success or failure. Offline attacks compute candidate hashes and compare them with stolen records. Long unpredictable passwords increase the search effort, while proper salted, deliberately slow password hashing increases the cost of each offline guess.

How people get tricked

No one needs to click a link. The weakness may be a short predictable password, exposed service, or poor storage. Formal complexity requirements do not prevent familiar patterns from being guessed quickly.

Example scenario

A stolen database contains weakly protected password hashes. The original site has strict login rate limits, but the attacker guesses those hashes offline without ever using its login page.

Warning signs

• Repeated failed logins or attempts against exposed remote services.
• Unfamiliar success after a period of failures.
• A breach of password records creates offline risk even without login alerts.

If it happens to you

Investigate successful access, revoke suspicious sessions, and reset exposed credentials. After a hash breach, assess storage strength and notify affected users appropriately; absence of online guessing does not remove offline exposure. Repair the service or storage weakness as well as changing passwords.