Brute Force Attack.
An attack that tries many credentials against a single account or many accounts to find a match, classically password-guessing, in practice often credential-stuffing.
Pure password-guessing brute force is rarely effective in 2026 against any properly-configured auth surface. The dominant volume attack is credential stuffing using leaked passwords, which technically isn't brute force but is the practical successor. Focus defenses on credential stuffing patterns and the passkey migration, not on traditional brute-force-specific controls.
Common questions
How is brute force different from credential stuffing?
Does account lockout stop brute force?
What rate limits prevent brute force?