Brute-force attack

A trial-and-error method that systematically tests possible passwords, keys, or other inputs until one produces the desired access or result.

Password cracking: The recovery or discovery of passwords by testing candidates or exploiting weaknesses in password storage and use. Brute-force attacks are one way to discover passwords, though cracking also uses other techniques.
Password: A secret string used to authenticate a person or authorize access. Passwords are common targets because services can accept repeated guesses.
Credential stuffing: An attack that tries username-password pairs leaked from other services against a target service. It reuses known credentials rather than generating candidates through systematic search.
Brute-force search: An algorithmic method that checks candidate solutions systematically until it finds one or exhausts the possibilities. The attack is a security-focused use of this general search strategy.
Exhaustive key search: A search that tests every possible cryptographic key until decryption or verification succeeds. This is brute force applied specifically to cryptographic keys.
Cryptographic key: A value that controls a cryptographic algorithm's operation, such as encryption or decryption. A key's possible values form the candidates in an exhaustive key search.
Rainbow table: A precomputed data structure used to reverse password hashes by trading storage for computation. It can avoid repeating hash calculations that a direct brute-force search would perform.
Password cracking software: Programs that test password candidates against login systems or stored password hashes. Such tools automate candidate generation and verification during authorized audits or attacks.
Search space: The set of candidate solutions that an algorithm may examine. Its size determines how many attempts a complete brute-force search may require.
Hash function: A function that maps input data to a fixed-length output, often used to store password verifiers. Attackers can test guesses against stored password hashes without submitting them to a login service.

Linked from 4 pages