Brute Force Attacks: How Password Cracking Really Works

A Breach Happens at 2 AM. Here Is What Occurs Next

A retailer gets breached. The attackers walk away with a database of ten million email and password hash pairs. Nobody logs into anything on the retailer's live site, because that would trip rate limits within seconds. Instead the file moves to a rented machine with a handful of consumer graphics cards wired together, and a program starts testing guesses against the hashes, completely offline, with no lockout, no CAPTCHA, and no one watching. This is the scenario that makes brute force attacks worth understanding in concrete numbers rather than as an abstract scare word.

Brute force, at its core, is unglamorous: try a guess, check if it matches, try the next one. No exploit, no cleverness, just relentless computation. What changed over the last decade is how cheap that computation became. A single modern gaming GPU can test billions of candidate passwords per second against a weakly protected hash. Stack eight of them in a rig, which costs less than a used car, and the number climbs into the tens of billions per second.

Why the Storage Method Decides Everything

The speed of an offline attack depends almost entirely on how the target stored the password, not on how clever the attacker is. Three storage choices produce wildly different outcomes for the exact same stolen file:

MD5 (obsolete): Built for speed, not secrecy. A cracking rig can run hundreds of billions of guesses per second against it. Any password under twelve characters falls quickly.
Plain SHA-256: Also built for speed. Tens of billions of guesses per second are realistic. It is the right tool for verifying file integrity and the wrong tool for passwords.
bcrypt or Argon2 (proper password hashing): Deliberately slow by design, often tunable to take a fraction of a second per guess. The same rig drops to tens of thousands of guesses per second, a difference of six or seven orders of magnitude compared to MD5.

That gap, millions of times slower, is the entire reason security engineers insist on bcrypt or Argon2 for password storage and never plain hashing. If you want to see hash output for yourself, our free hash generator runs entirely in your browser, and our SHA-256 vs MD5 comparison explains why one is fine for files and the other is a liability for logins.

Four Ways Attackers Actually Guess

Nobody tries "aaaa" then "aaab" against a real target except in movies. Real attacks are ordered by probability:

Dictionary attacks: Real words, names, and the billions of passwords already leaked from other breaches, tried first because humans reuse patterns constantly.
Rule based or hybrid attacks: Dictionary words run through the same transformations humans apply out of habit: capitalize the first letter, add a digit or the current year, swap a letter for a symbol. "Summer2026!" looks complicated to a person and falls in the first minute to software that already knows the trick.
Mask attacks: Used when an attacker has partial knowledge of the pattern, for example that a company enforces exactly eight characters with one digit at the end. Knowing the shape of the password collapses the search space enormously.
Pure exhaustive brute force: Trying every combination in order. Reserved for short passwords, because the combination count explodes past practicality once length grows.

The Math Nobody Bothers to Calculate

Using the full 94 character keyboard set as the pool, each added character multiplies the total number of possible passwords:

8 characters: roughly 6 quadrillion combinations. Against a fast unsalted hash, hours. Against bcrypt, still uncomfortably reachable for a determined attacker.
12 characters: roughly 5 x 10²³ combinations. Years to centuries even at high guess rates.
16 characters: roughly 4 x 10³¹ combinations. Past any timescale worth planning around.

The practical lesson is that length overwhelms complexity math in a way most people never expect. "Tr0ub4dor&3" is eleven characters of exactly the substitutions cracking rules already anticipate, and it fails long before "correct horse battery staple", which is twenty eight characters of plain dictionary words with no symbols at all. This is the entire logic behind passphrases, covered in depth in our passphrase vs password guide. You can check where your own password lands using our password strength checker, which never sends anything off your device.

Attackers do not search in alphabetical order. They search in probability order: known leaked passwords first, dictionary words second, human habit patterns third, pure randomness last. A password's real strength is measured by its distance from human habits, not by how many symbol types it contains.

Online Attacks Are a Different Animal Entirely

Everything above describes an offline attack against a stolen file. Guessing directly at a live login page is a much slower, noisier game. Sites rate limit repeated attempts, lock accounts after a handful of failures, and throw CAPTCHAs at suspicious patterns. Because of that, attackers rarely throw millions of guesses at one online account. Instead they run password spraying: trying a small handful of extremely common passwords, like "Password1" or a season plus year, across thousands of different accounts, staying under each site's lockout threshold. If your password is not sitting in the top few thousand most common passwords in the world, online guessing essentially never reaches it. Offline guessing against a breach, by contrast, has no such ceiling, which is why the storage method matters so much more than most people assume.

Building Real Defenses, in Priority Order

Use long, random, unique passwords per site, fourteen characters or more. Generate them rather than invent them: our password generator pulls randomness straight from your browser's cryptographic API.
Turn on two factor authentication everywhere it is offered. A cracked password stops being useful the moment a second factor is required, and a TOTP secret runs on 160 bits, a search space no brute force rig will ever meaningfully dent. Start with our 2FA guide or generate a code right now with our free TOTP generator.
Adopt a password manager. It is the only realistic way to keep fifty or more unique random passwords straight.
If you build or run a login system, hash with Argon2 or bcrypt using a real, tested cost factor, enforce rate limiting and lockouts on the login endpoint itself, and never write custom cryptography. Our developer 2FA guide covers implementing the server side properly.

Frequently Asked Questions

Could someone brute force my six digit 2FA code?

A six digit TOTP code has one million possible values and a thirty second window before it expires, and the server enforces rate limiting on attempts. Running through that space in the time available is statistically hopeless. The 160 bit secret behind the code is the part that would actually need cracking, and no available computation touches that number.

How does an attacker even know a guess is correct in an offline attack?

They already have the stolen hash from the breach. The attacker hashes each guess using the same algorithm the site used and compares the output to the stolen value. A match confirms the password. This is exactly why the hashing algorithm's speed is the entire battlefield, and why a site still using MD5 puts every one of its users at elevated risk regardless of how strong their individual passwords are.

Is an eight character password with a symbol and a number still acceptable?

Not anymore. Eight characters falls to modern rigs quickly regardless of how much symbol decoration is added. Twelve characters is closer to a reasonable floor today, and fourteen or more is comfortable. Four random words in a row genuinely outperform eight random symbols, for both security and memorability.

What exactly is password spraying, and how is it different?

Password spraying flips the usual attack around: instead of trying many passwords against one account, it tries a small number of very common passwords against many accounts at once, deliberately staying under each account's lockout threshold. It is a common way corporate breaches begin, and it is the reason banning common passwords outright matters more than demanding symbols.

Do account lockouts make brute force pointless?

They help enormously against online attacks, though they can be abused to lock a legitimate user out as a denial of service tactic. Against an offline attack on stolen hashes, lockouts do not apply at all, because nothing on the attacker's own rented hardware enforces them. Treat any breach notification as though your hash is being actively cracked right now, and let a unique password per site contain the blast radius.