Why guessing becomes expensive
A brute-force attack does not need to understand a password’s meaning. It tests candidates—often starting with common choices, then moving through combinations—until one matches. The challenge is the size of the search space: adding possible characters or length can multiply the number of guesses dramatically. A longer, less predictable password is therefore harder to find than a short one, even if the attacker has powerful computers.
Where the guesses happen matters
If guesses are submitted to a live sign-in page, the service can slow or block repeated attempts, require extra verification, or temporarily lock an account. Those limits make each guess costly. In a different scenario, an attacker may steal a stored password verifier—the data a system uses to check a password—and test guesses offline, without contacting the service. That can allow far faster testing, so systems protect stored passwords by using salts and deliberately slow hashing methods. A salt is a random value added before hashing; it helps prevent attackers from reusing precomputed results across many accounts.
Make the search space harder to reach
Length and unpredictability matter because they increase the work required to find a match. Reusing a password also creates a shortcut for attackers: a password exposed from one service may be tried on another. Unique passwords, stored in a password manager, reduce that risk; multifactor authentication adds another check beyond the password itself.
The core tradeoff is simple: every added layer makes a successful guess less likely or more expensive. Brute force is not a magic way through a secure system—it is a race between the attacker’s ability to test candidates and the defenses that limit or slow those tests.
