What Is a Brute-Force Attack? GCSE Computer Science

In brute force attack GCSE computer science terms, an attacker's program systematically tries every possible password combination, one after another, until it finds the one that works. It relies on raw computing power and time rather than tricking a user, which is why password length and account lockouts are the main defences.

What is a brute-force attack?

A brute-force attack is a method of "cracking" a password (or an encryption key) by trying every possible combination of characters until the correct one is found. There is no cleverness involved — the attacking software simply works through possibilities systematically, starting from something like aaaa, then aaab, aaac, and so on, until it stumbles on the real password.

Because modern computers can attempt thousands or millions of combinations per second, brute-force attacks are a genuine threat against short or simple passwords, even though the method itself is completely unsophisticated. GCSE specifications group brute-force attacks under network and cyber security threats, alongside malware, phishing, SQL injection and denial-of-service attacks.

How does a brute-force attack actually work?

A typical brute force attack GCSE computer science question asks you to trace this loop: guess a password, submit it, check whether access was granted, and if not, move to the next guess. This can target a login screen directly, or — more commonly in practice — an attacker who has already stolen a file of encrypted (hashed) passwords and runs the guessing process offline on their own computer, where there is no lockout to stop them.

Worked example. Suppose a password is exactly 4 characters long, using only lowercase letters (26 possible characters per position). The total number of possible combinations is:

$$26^4 = 456{,}976$$

If an attacker's program can test 1,000 guesses per second, the maximum time to guess every combination is:

$$456{,}976 \div 1{,}000 \approx 457 \text{ seconds (about 7.6 minutes)}$$

Now compare this with an 8-character password using lowercase letters, uppercase letters and digits (62 possible characters per position):

$$62^8 \approx 2.18 \times 10^{14} \text{ combinations}$$

At the same guessing rate, that would take roughly 2.18 × 10¹¹ seconds — over 6,900 years. This is the core exam idea: every extra character, and every extra character type, multiplies the search space and makes a brute-force attack dramatically slower.

How does password length affect brute-force security?

The table below shows how quickly the number of possible combinations grows as password length and character variety increase.

This is why GCSE mark schemes reward the explanation "increasing password length increases the number of possible combinations exponentially, so it takes a brute-force attacker much longer to succeed" over a vague answer like "longer passwords are safer."

What is the difference between a brute-force attack and a dictionary attack?

Both attacks aim to guess a password without the user's knowledge, but they search in different ways:

• A brute-force attack tries every possible combination of characters, with no assumptions about what the password looks like. It is slow but guaranteed to succeed eventually against any password, given enough time.
• A dictionary attack only tries words and phrases from a pre-built list — real words, common passwords like password123, names, and known leaked passwords. It is much faster than a full brute-force search but only works if the real password happens to be in the dictionary list used.

In practice, attackers often combine both: run a fast dictionary attack first, then fall back to a full brute-force search (sometimes adding common substitutions such as @ for a) if the dictionary attempt fails.

How can brute-force attacks be prevented?

Several defences reduce the risk of a successful brute-force attack, and GCSE questions typically expect you to name and explain more than one:

• Strong password policies — requiring a minimum length and a mix of character types, which increases the search space exponentially, as shown above.
• Account lockout after failed attempts — locking an account (temporarily or fully) after, say, five incorrect password attempts stops an online attacker from making unlimited guesses.
• CAPTCHA — forcing a human-only test after a small number of failed logins, which blocks automated guessing software.
• Two-factor authentication (2FA) — even a correctly guessed password is not enough on its own, because a second code (e.g. sent to a phone) is also required.
• Salting and hashing passwords — storing passwords as unique, scrambled hashes rather than plain text means that even a stolen password file cannot be used directly, and an offline brute-force attempt on a hash is far slower than a simple text comparison.

Frequently asked questions

How does a brute-force attack work in simple terms?

An attacker's program automatically tries every possible password, one combination at a time, checking each one until it finds the correct match. It does not need to know anything about the target — it relies purely on trying enough combinations that the right one eventually comes up.

What is the difference between a brute-force and a dictionary attack?

A brute-force attack tries every possible character combination with no assumptions, which is slow but always works eventually. A dictionary attack only tries real words and known common passwords from a pre-built list, which is much faster but fails completely if the password is not on that list.

Why does password length matter so much against brute-force attacks?

Each additional character multiplies the total number of possible combinations, so search time grows exponentially rather than in a straight line. A 4-character lowercase password can be cracked in minutes, while a 10-character password mixing letters, digits and symbols can take longer than a human lifetime to brute-force at the same guessing rate.

Can a brute-force attack be stopped completely?

No single defence guarantees complete protection, but combining a strong password policy, account lockouts, CAPTCHA and two-factor authentication makes a successful brute-force attack extremely unlikely in practice. Most real-world defences focus on making the attack too slow or too costly to be worthwhile, rather than making it mathematically impossible.

Want a subject specialist to test your understanding of network security threats with real exam-style questions? Add the AI Tutors connector at aitutors.me.