Brute-Force Search
Brute-force search is a solution method that simply tries out all conceivable possibilities one after another until one fits. It is always correct, but often prohibitively slow — and that's precisely why it also protects passwords and encryption.
Imagine you have a four-digit combination lock and have forgotten the code. You could set it to 0000, then 0001, then 0002 — and so on, until the lock opens. After at most 10,000 attempts, you’re done. This exact procedure is called brute-force search in computer science, roughly meaning “search by raw force.” The computer tries all possible answers one after another, without any clever thinking, and checks each one to see if it’s correct. This method is thus the exact opposite of an elegant trick: it wins not through cleverness, but through sheer persistence.
The benchmark every smarter method must measure up to
Brute force has a property that no other method offers as reliably: it is guaranteed to find the solution if one exists. It cannot overlook anything, since it examines every single possibility. That’s why it often serves as a reference in practice. When someone develops a fast algorithm, it is tested on small examples against the complete search. If the results diverge, there is a bug in the fast method.
The price for this is computing time, and it grows brutally fast. For an eight-character password with uppercase and lowercase letters, digits, and special characters, there are roughly 6 quadrillion combinations. Add just a single character, and the number grows roughly 95 times larger again. Experts call this exponential growth. It means that a computer twice as fast barely helps with such problems.
Yet this very growth is also the reason modern encryption works. A common key has 256 bits, which is more combinations than there are atoms on Earth. All the computers in the world combined would not be able to try them all within billions of years. Security here doesn’t arise because brute force is impossible, but because it is unaffordable.
Going through all combinations — and where you can take shortcuts
Technically, a brute-force search needs only two building blocks. First, a generator that systematically produces all candidates, without forgetting any or delivering duplicates. Second, a test that states for a candidate: fits or doesn’t fit. In a chess program, a candidate would be a sequence of moves; for a password, a string of characters. The rest is a loop that runs the test millions of times.
In practice, shortcuts are almost always built in. In so-called backtracking, the program abandons a branch as soon as it becomes clear that it can no longer lead to the goal. Someone solving a Sudoku doesn’t need to check all continuations after hitting a contradictory number. Such methods are still brute force at their core, but they save enormous portions of the search space. This is called pruning.
A second trick is parallelization. Since the attempts are independent of one another, they can be distributed across thousands of processor cores. Graphics cards are particularly well suited for this. This shifts the boundary of what’s feasible, but doesn’t eliminate it: even a data center is no match for exponential growth.
From cracked passwords to model search in AI
The term is most commonly encountered in reports about security vulnerabilities. Attackers there try out massive numbers of passwords, often using stolen lists of common combinations. That’s why banks lock accounts after three incorrect PINs, and websites require a captcha after several failed attempts. These brakes don’t attack the method itself, but rather its speed.
Brute force also appears in AI development, just under different names. In grid search, one systematically tries out all combinations of settings for a model, such as learning rate and training step size. This is expensive, which is why random or specifically guided searches are generally preferred today. Incidentally, a common misconception is that modern language models find answers through trial and error. They compute their answer in a single pass, rather than testing millions of variants.
Nevertheless, the method remains useful when the search space is small. For 20 possible seating arrangements, no sophisticated algorithm is worthwhile. There, the complete search can be written in five lines, is immediately understandable, and guaranteed correct. This trade-off between effort in programming and effort in computing is one of the most common decisions in software development.