Tu contraseña es débil: cómo funciona un ataque de fuerza bruta (y cómo defenderte)

Imagine a bike lock with a four-digit combination. How many possible combinations exist? Ten thousand: from 0000 to 9999. If you could try one combination per second, it would take less than three hours to open it… but a computer doesn't test one at a time; it tests billions at once. That is, in essence, brute force: not guessing cleverly, but trying everything, incredibly fast, until something opens.

Such is a real brute force attack. When an internet service suffers a leak, attackers don't get your password in plain text (or they shouldn't): they receive your "hash," a one-way digital fingerprint calculated by a mathematical function. It can't be reversed, but it can be compared: if I calculate the hash of "password123" and it matches the leaked hash, I know your password.

And that's where the party begins for the attacker. Dictionaries: first try the most commonly used passwords on the planet. "123456," "password," "qwerty" and millions of variations previously leaked. Most accounts fall here, without brute force "purely." Mutation rules: the software tries "gato" → "Gato" → "gato1" → "gato2024" → "g4t0."

Humans are predictable even "being creative." Full brute force: eventually, all possible character combinations. This is only viable if the password is short: each extra character multiplies the work of the attacker (for once). The mathematics that protects you The security of a password does not depend on how "odd" it looks, but on how many possibilities the attacker must explore, which depends on its length and the alphabet used.

An 8-character lowercase password has about 200 billion combinations: it sounds a lot, but a modern graphics card team goes through them in hours if the hash is fast and weak. One with 16 characters, including uppercase, lowercase, numbers and symbols, moves to a space so large that even with centuries of computing it's not traversed.

That's why a long and memorable phrase — several words combined, as you'd use in an absurd story — usually protects more than a short key full of impossible-to-remember symbols. And the link that almost no one takes care of: reusing. The most successful attack doesn't even break your password: it recycles it. If you use the same key in the forum that leaked in 2019 and in your email, the attacker only has to try that combination email+password in all known services.

It's called credential stuffing and works because millions of people reuse keys. Your defense, in five steps: long and unique phrases per service. Longer wins over complicated; unique wins over everything. A password manager. You can't memorize 80 unique keys; the manager can. Only memorize one master, made well. Two-factor authentication (2FA) always.

Even if they steal your password, without the second factor they can't get in. Use an authenticator app rather than SMS. Check if you've been leaked. Services like Have I Been Pwned tell you if your email appeared in known leaks. Beware of prudence. Brute force breaks locks; social engineering opens people. Banking doesn't ask for your key by email.

Brute force is the least elegant and one of the most effective attacks, because it attacks our shortcuts. The good news is that defense is also mathematical and is on your side: each extra character you add, the attacker pays with years. José Ángel Maldonado Guzmán — computer engineering student, Autonomous University of State of Mexico, Valle de Chalco University Center.