What Is a Brute-force Attack?

What to do: Use long passwords: at least 16 characters, and ideally 20 or more. Length matters more than symbols.

A burglar has to try the doorknob before getting in. If the door is locked, they might decide your house is too much trouble and move on to the next one. But what if the burglar had a machine that could try the doorknobs of millions of houses every second? That’s what attackers can do online. You don’t have to be singled out to be attacked. Every doorknob in the neighborhood gets tried.

Now imagine the machine also has an endless supply of blank keys. Most houses have common, ordinary locks, and the machine knows how they work. When it finds a locked door, it starts cutting keys in every possible shape, one after another, until one fits. It can try millions of keys every second.

That’s a brute-force attack: a computer guessing every possible password until it finds yours.

How to Protect Yourself

The machine is counting on you having a simple lock. A more complicated lock means many, many more keys to try. That takes so long that the machine gives up, or your alarm goes off first.

For passwords, the “complicated lock” is length. Every extra character makes your password much harder to guess. That’s why many sites require at least 8 characters, though we recommend much longer: at least 16 characters, ideally 20 or more.

A strong password does not have to be a jumble like P@ssw0rd!. This comic explains why:

Comic: xkcd #936 by Randall Munroe, CC BY-NC 2.5.

Passwords full of symbols tend to be short, because long ones are impossible to remember. A short password is easier to guess.

Next: Dictionary Attacks