Brute Force

ELI5 — The Vibe Check

Brute force is the dumbest but sometimes effective hacking technique — just try every possible password until one works. No creativity needed. Hackers use bots that can try millions of combinations per second. Rate limiting, account lockouts, and long passwords are the defense.

Real Talk

A brute force attack systematically tries all possible input combinations to find a valid credential or key. Online brute force targets login forms; offline brute force cracks stolen password hashes. Defenses include rate limiting, account lockout, CAPTCHA, MFA, and strong password policies.

Show Me The Code

// Rate limit login attempts with express-rate-limit
import rateLimit from 'express-rate-limit';

const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5, // 5 attempts per window
  message: 'Too many login attempts, try again in 15 minutes',
});
app.post('/login', loginLimiter, loginHandler);

When You'll Hear This

"The login endpoint was getting brute forced — add rate limiting." / "A 12-character random password takes centuries to brute force."