What is a brute force attack?

A brute force attack is a way to try and break through sensitive data like passwords and encryption keys. It works by submitting different combinations of characters until the right one is found. Brute force attacks are often used to break into websites by using scripts or bots that target the login page, and can also be used to attack API keys and SSH logins. While this type of attack relies more on luck than intelligence, it is effective when used against shorter passwords and weaker encryptions.

One advantage of a brute force attack is that they eventually work if given enough time and the lack of a mitigation strategy for the target. But they are very slow and can take days, months, or even years to decode a properly randomized password. The longer the target string (combination of characters), the more difficult it becomes, and decoding encryption keys can take even longer. 

Encryption keys are random strings of bits generated to scramble and unscramble data. Brute force attacks can also crack encryption keys, but it would take so long to crack using modern computers that they are considered as good as unbreakable. A longer encryption key is much more secure than a shorter one, and 256-bit encryption keys are recommended for web services that collect user information.

Developers can protect against brute force attacks by locking out IP addresses that have generated too many failed logins, and incorporating a delay in their password-checking software. Similarly, users can protect themselves by choosing longer, more complex passwords and enabling two-factor authentication. Using these more complex passwords and encryption keys effectively protects against brute force attacks.

Looking to learn more? We suggest heading over to Cloudflare’s Learning Center for an in-depth look at brute force attacks.