Brute-Force Analysis

Imagine you have a four-digit combination lock and forgot the code. You could guess, think it over, consider birthdays. Or you start at 0000 and stubbornly count up to 9999. By the last attempt at the latest, you’re in. This exact approach is called brute force: one systematically tries out all possibilities until one fits. A brute-force analysis is therefore not a clever method, but a thorough one. Its only tool is computing time.

The benchmark for every smarter method

Brute force is important because it is guaranteed to work. If the solution lies within the searched space, it will be found. With more sophisticated methods, on the other hand, one must first prove that they haven’t overlooked anything. Experts therefore use exhaustive trial as a benchmark: a new algorithm, i.e. a fixed computational procedure, is only worth something if it is significantly faster than mere trial and error.

The second meaning lies in security. Passwords and encryption don’t protect because they are unbreakable, but because trying them all takes too long. A four-digit PIN has 10,000 combinations – a computer manages that in milliseconds. A random twelve-character password has more combinations than there are grains of sand on Earth. Security here is thus a calculation about time, not a question of secrets.

That is precisely why advances in computing power are news for the financial markets. What was considered secure in 1998 can today be broken with rented computing power from the internet. Entire encryption methods have already been replaced for this reason.

Why trying everything explodes so quickly

The core problem is called combinatorial explosion. Every additional character in a password multiplies the number of possibilities. With ten allowed characters, one more position means: ten times as much work. Five more positions mean a hundred thousand times as much work. The task doesn’t grow step by step, but in leaps.

A well-known example is the traveling salesman problem: a delivery van is supposed to find the shortest route through several cities. With ten cities, a computer can check all routes. With sixty cities, there are more routes than atoms in the visible universe. No computer in the world can manage that with blunt trial and error.

In practice, brute force is therefore mitigated. One narrows the search space, sorts likely candidates to the front, or aborts partial paths early if they are already worse than the best known solution. Dictionary attacks also belong to this category: they first test common passwords before blindly continuing to count. That is then no longer pure brute force, but a guided search.

From password attacks to AI research

In everyday life, you mostly encounter brute force as a defensive measure. When your phone forces a waiting period after several wrong codes, it prevents exactly this rapid trial and error. Banks lock accounts after a few failed attempts for the same reason. Mining cryptocurrencies is also, at its core, brute force: computers keep guessing numbers until one fits.

In the AI world, the term often appears as an accusation. Critics say large language models are built primarily with brute force: more data, more chips, more computing time instead of new ideas. Conversely, some systems deliberately employ the principle. A model generates twenty proposed solutions and then checks which one is correct. This costs more computing power but delivers better results.

A common misconception is that brute force is the same as stupidity. It is a deliberate decision to trade computing time for thinking work. As long as chips become cheaper than clever algorithms are expensive, this trade-off remains attractive. This explains, in part, the billions in investments in data centers.