How a brute force attack works
In its simplest form, software cycles through every possible combination of characters. More efficient variants try common passwords, dictionary words, and leaked credentials, which is called a dictionary attack or credential stuffing when stolen username and password pairs are reused on other sites.
Attacks can be online, where guesses are sent to a login page, or offline, where an attacker cracks a stolen password hash on their own hardware. Offline attacks are faster because there are no lockouts, so strong hashing and long passwords matter greatly.
Why it matters for Canadian organizations
Internet-facing services such as remote desktop, VPN gateways, and email portals face constant automated guessing. A single weak or reused password can give an attacker a path into email, cloud accounts, or the corporate network.
Successful account takeover can lead to a reportable breach under PIPEDA or Law 25 when personal information is exposed. The Canadian Centre for Cyber Security recommends long passphrases and multi-factor authentication, and insurers commonly ask whether MFA is enforced on remote access before issuing coverage. Public-facing login pages are tested constantly.
How to defend against it
Require multi-factor authentication on every external service, which neutralizes most password guessing. Enforce long passphrases, block known-breached passwords, and apply rate limiting or temporary lockouts after repeated failures.
Do not expose remote desktop or administrative interfaces directly to the internet. Store passwords using slow, salted hashing algorithms. Monitor authentication logs for bursts of failures, unusual sources, and success after many failures, since these patterns are strong signs of an attack in progress. Alert on any successful login that follows a long run of failures.
Frequently asked questions
What is the difference between brute force and credential stuffing?
Brute force guesses passwords systematically, while credential stuffing tries real username and password pairs leaked from other breaches. Both exploit weak or reused passwords, and both are stopped most effectively by multi-factor authentication. Passwords that are long, unique, and stored in a password manager resist both approaches.
How long does it take to brute force a password?
It depends on length, complexity, and the attacker's hardware. Short or common passwords can fall in seconds, while long random passphrases can take impractically long. Length is the most important factor for resisting guessing. Length matters more than clever substitutions, so prefer passphrases of several unrelated words.
Does MFA stop brute force attacks?
It stops most of them from succeeding, because a guessed password alone is no longer enough to log in. Attackers may still attempt other methods such as phishing the second factor, so use phishing-resistant MFA where possible.
Related service: Identity and access management