Home / Knowledge hub / Brute force
Knowledge hub
Brute force
Trying passwords or codes over and over until one of them works.
What it means
A brute force attack means trying passwords or codes over and over until one works. It is not subtle and it does not need to be. Computers are patient, and most attempts cost the attacker close to nothing.
The targets go wider than login passwords: six digit one time codes, password reset tokens, discount codes, invite links, and any short identifier that grants something.
Why it matters
A cleverer password rule is not the defence. Long complexity requirements mostly produce predictable substitutions and a note stuck to a monitor. Making attempts expensive works. Slow them down, lock the account after a handful of failures, and apply the limit per account as well as per address.
Credential stuffing is the version that matters most now. The attacker does not guess at all. They replay passwords leaked from somewhere else, and limits tuned for guessing rarely catch it.
There is a business cost even when the guessing fails. Sustained attempts fill your logs, lock out real customers, and turn your support queue into a queue of people who cannot get in.
How it shows up
Check the limits where nobody looks. The login form usually has one. The API version of the same login often does not. Nor does the one time code check, the reset token lookup, or the endpoint that resends a code. That last one keeps a fresh guessable code in flight indefinitely.
Then check what happens after a limit trips. A lockout an attacker can trigger on any account by name becomes a way to lock out your customers.
Questions people ask
Brute force, answered
Is a CAPTCHA on the login page enough?
No. It raises the cost of automation, and services exist that solve them for a small fee. Treat it as friction rather than a wall.
Bring it in after a few failures instead of showing it to everybody. Your customers then get a normal login, and the person guessing meets it straight away.
Should we count failed attempts per address or per account?
Both, because they catch different attacks. Counting per address stops one machine hammering one login. Counting per account catches the spread attempt that tries one password against thousands of accounts from thousands of addresses.
Address limits on their own are the common mistake. A fresh address costs pennies, and mobile networks share addresses between real customers anyway.
Will locking accounts let somebody lock out our customers?
Yes, if the lock trips easily and only a person can clear it. Anybody who knows your customers' email addresses can then close their accounts for them, which is a denial of service you built yourself.
Prefer a delay that grows with each failure and clears itself. Keep hard locks for accounts under sustained attack, and give people a way back in that does not need your support team.
What is the difference between throttling and an account lockout?
Throttling slows attempts down and then lets them continue. A lockout stops them until something clears it. One is a speed limit, the other a closed door.
Throttling handles the ordinary case better, because the real customer who fumbled a password is only delayed. Lockouts are blunt, which is exactly why attackers enjoy triggering them.
How would we know this is happening to us right now?
Look at failures rather than successes. A rising count of failed logins, spread across many accounts, or many accounts each failing once, is the pattern worth an alert.
Watch the endpoints behind the form as well: code checks, reset token lookups and resend routes. Those rarely reach a dashboard, and they are usually where the attempts go.
Related
Terms that sit next to this one
Rate limiting
Capping how often something can be attempted, per user or per address.
Credential stuffing
Trying passwords leaked elsewhere, because people reuse them.
Account takeover
An attacker ends up signed in as one of your real users.
MFA
A second proof beyond the password, usually a code or a hardware key.
TOTP
The six-digit code from an authenticator app, changing every thirty seconds.
Limits only on the login form?
We check the endpoints behind your form too: code checks, reset lookups, resend routes, and limits that reset with a new address. You get the request that got through. Get in touch.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.