# What is a Brute-Force Attack?

> A brute-force attack repeatedly tests candidate values or credential combinations to obtain access or recover a secret.

- Canonical URL: https://yellowcube.eu/glossary/brute-force-attack/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

In authentication, candidates can be checked online by a service or offline against captured password verifiers or encrypted material. The term is an umbrella for strategies such as concentrated password guessing, password spraying, and credential stuffing, even though their candidate sources and account distributions differ.

Online attempts create verifier events and may be distributed to avoid simple thresholds. Offline attempts occur after protected material is obtained and create no sign-in failures, so protections and evidence differ.

### Key points

- **Candidate patterns:** Many candidates may be tested against one account, a small candidate set across many accounts, or exposed credential pairs against other services; each pattern changes detection and lockout risk.
- **Evidence:** Correlate failures and successes across accounts, sources, devices, services, and time, while checking for account discovery, password-verifier theft, recovery abuse, and activity after a successful sign-in.
- **Risk reduction:** Use phishing-resistant multi-factor authentication (MFA) where appropriate, reject compromised passwords, protect stored verifiers with suitable password hashing, rate-limit attempts, and design recovery and alerting for abuse.
- **Important limitation:** Rate limits and account lockouts do not stop offline attacks and can be evaded by low-rate or distributed attempts. Overly aggressive lockout can also deny service to legitimate users, while a successful login does not reveal how the credential was obtained.

### Related terms

[Credential stuffing](<https://yellowcube.eu/glossary/credential-stuffing/>) · [Login credentials](<https://yellowcube.eu/glossary/login-credentials/>) · [Authentication](<https://yellowcube.eu/glossary/authentication/>) · [Account takeover (ATO)](<https://yellowcube.eu/glossary/account-takeover/>) · [Identity-based attack](<https://yellowcube.eu/glossary/identity-based-attack/>) · [Password spraying](<https://yellowcube.eu/glossary/password-spraying/>)

### Sources

[MITRE ATT&CK T1110: Brute Force](https://attack.mitre.org/techniques/T1110/) · [NIST SP 800-63B-4: Authentication and Authenticator Management](https://pages.nist.gov/800-63-4/sp800-63b.html) · [OWASP Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.