What is a brute-force attack? A simple guide

Encryption for private files

Sealby

Files are encrypted on your device

Photos, videos, notes and documents are encrypted individually, with keys protected by Apple hardware security.

See how Sealby protects your files

Device encryption

Protects a locked phone

Excellent baseline protection, but apps can read their own data after the device is unlocked.

End-to-end encrypted cloud

Useful for private remote storage

The provider cannot normally read file contents, though account and recovery design still matter.

Password-protected files

Depends on the format and password

A strong modern format can work well; a weak password or old format can undo the encryption.

Password guessing, at scale

A brute-force attack is the digital version of trying every number on a combination lock. The attacker tests one password, PIN, or key after another until one opens the door.

A three-digit lock has only 1,000 codes, from 000 to 999. Given enough attempts, every code can be tried. The same idea applies to accounts, stolen password databases, and encrypted files.

What makes an attack succeed

First: how many possible secrets exist. A six-digit PIN has one million values. A long passphrase made from random words has vastly more.

Second: how fast each guess can be checked. A website may pause or block repeated guesses; a leaked password database may be tested much faster. Good security increases the options and slows each guess.

Why a longer passphrase helps

A short password with symbols can look strong: P@ssw0rd! is a familiar example. But attackers try common substitutions such as @ for a and 0 for o, so this pattern is not as unusual as it looks.

Adding length is more useful. Every extra word multiplies the possible combinations. A passphrase of several random, unrelated words is stronger and often easier to type correctly. Create your own unique one, ideally with a password manager.

How devices slow down guessing

A secure service checks passwords through a deliberately slow process, so a small delay for you becomes a huge cost for someone testing millions of guesses.

It should also limit attempts. Your iPhone creates longer waits after wrong passcodes and can erase data after repeated failures. A short PIN is not a substitute for a strong password where guesses are fast and unrestricted.

A practical way to protect yourself

Use a different long passphrase for important accounts and turn on two-factor authentication. Store unique passwords in a trusted password manager.

For encrypted files, Sealby turns your PIN or passphrase into a key through a slow, memory-heavy process. Unlocking also happens on your device, where iPhone delays and attempt limits apply.

Quick answers

What is a brute-force attack in simple terms?

It is guessing a secret one possibility at a time, like trying every number on a combination lock. It works only when there are few enough choices or guesses can be tested quickly.

How long does it take to brute-force a password?

It can take seconds or far longer than a human lifetime. Common, short passwords fall quickly; every extra random word creates many more possible guesses.

Is a longer or a more complex password better?

Length usually wins. A long, unique passphrase made from several random words is harder to guess than a short 'complex' password and is easier to remember. More length means many more possible combinations.

How do devices stop brute-force attacks?

They slow each guess and limit attempts. A phone can add waiting time, lock itself, or erase data after repeated wrong passcodes. That makes a PIN much safer on a device than in a leaked file with unlimited guesses.

← Learn

What is a brute-force attack?