Secordit home
Contact

What is a brute-force attack?

A brute-force attack is the automated guessing of large numbers of passwords until the correct one is found. That is the NCSC's definition. It is different from password spraying, which tries a few common passwords against many accounts. It is also different from credential stuffing, which reuses passwords leaked from another site. 12

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

  1. Software tries a large number of password guesses against one account, until one works or the attempts are stopped. 1
  2. System owners can slow those guesses down (throttling) or lock the account after too many tries. The NCSC prefers throttling, because lockout can lock out real users or be used to cause a denial of service. 12
  3. If lockout is used, the NCSC recommends allowing 5 to 10 attempts. 1

How it can look

The NCSC password guidance for organisations explains brute-force attacks, throttling and lockout in the same place as password spraying and monitoring. For people, a password manager, unique passwords, and MFA or passkeys reduce the value of guessing. The NCSC does not treat a more complex memorable password as the main fix. 12

Warning signs

  • An account allows a very large number of password guesses with no slowing down and no alert. 1
  • A person uses a short, common, or reused password on an important account, especially without MFA or a passkey. 1
  • Repeated failed sign-ins appear on an account you did not try to use, which may be guessing or another form of attack. 12

What to do now

  1. Use a password manager so that every important account has a strong unique password. 1
  2. Turn on MFA or a passkey, so a guessed password is less useful on its own. 12
  3. If you run a service or a workplace login, follow the NCSC guidance: prefer throttling, and if you use lockout allow 5 to 10 attempts. 1

UK reporting and support

  • If you think an account has been taken over, follow the NCSC help for a hacked account. 3
  • For fraud or hacking in England, Wales or Northern Ireland, use Report Fraud. In Scotland, call Police Scotland on 101. 467
  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 5
  • If someone is in danger, call 999. 67

How to protect yourself

  • Give every account its own password, and store them in a password manager. 1
  • Add MFA or a passkey on important and internet-facing accounts. 21
  • If you manage logins at work, monitor repeated failures and prefer throttling over harsh lockout. 12

Frequently asked questions

If a site locks me out after a few wrong passwords, is that a brute-force attack?

Not necessarily. Lockout is a defence some sites use after several failed attempts, including ordinary typing mistakes. The NCSC prefers throttling, and if lockout is used it recommends allowing 5 to 10 attempts. A lockout on its own does not prove an attack. 1

How is a brute-force attack different from password spraying?

A brute-force attack tries a large number of guesses against one account. Password spraying tries a small number of common passwords against a large number of accounts. 12

How is it different from credential stuffing?

Credential stuffing reuses passwords already leaked from another site. A brute-force attack guesses large numbers of passwords, rather than using a stolen list from a previous breach. 1

Matching kit

Account Lockdown Kit · £19 · Digital download.

A self-serve guide to securing email, phone and online accounts. It does not promise to stop every attack.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. NCSC, Password policy: updating your approach | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  2. NCSC, 10 Steps: Identity and access management | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  3. NCSC, Help for individuals | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  4. Report Fraud, Report Fraud. Accessed 10 November 2026 (Europe/London).
  5. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 10 November 2026 (Europe/London).
  6. Police Scotland, How to report a crime - Police Scotland. Accessed 10 November 2026 (Europe/London).
  7. Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud. Accessed 10 November 2026 (Europe/London).