Password Guessing

Password Guessing Using the Brute Force Method

Password guessing using brute force is a simple example of the brute force problem-solving strategy. The basic idea is to systematically try every possible password combination until the correct one is found.

---

1. Basic Idea

Suppose a system uses a 3-digit password, where each position can contain a digit from 0 to 9.

The possible passwords are:

000
001
002
003
...
998
999

There are:

$$10^3 = 1000$$

possible combinations.

A brute-force approach checks these possibilities systematically.

000 → ✗
001 → ✗
002 → ✗
003 → ✗
...
527 → ✓

If the password is 527, the search stops when 527 is reached.

---

2. How Does It Work?

The process can be explained in four simple steps.

Step 1: Identify the Possibilities

Determine the possible characters and password length.

For our example:

Characters = 0–9
Password length = 3

Step 2: Generate Combinations

Generate every possible combination:

000
001
002
...
999

Step 3: Check Each Combination

Each candidate is compared with the password in the hypothetical example.

Candidate → Correct?
000       → No
001       → No
002       → No
...
527       → Yes

Step 4: Stop When Found

Once the correct combination is found:

527 → Correct ✓

the search stops.

---

3. Why Is This a Brute Force Method?

Because we are not using any shortcut or special knowledge about the password.

We simply say:

“Let's try every possible combination systematically.”

That is the fundamental idea of brute force.

---

4. Number of Possible Combinations

The number of possibilities increases rapidly as the password becomes longer.

If there are 10 possible characters and the password has length $n$:

$$\text{Number of combinations}=10^n$$

Password length	Possible combinations
1	10
2	100
3	1,000
4	10,000
5	100,000
6	1,000,000

This demonstrates an important algorithmic-thinking concept:

Increasing the input size can dramatically increase the amount of work required.

---

5. A Simple Flow

             Start
               ↓
      Generate a candidate
               ↓
        Check candidate
          ↙          ↘
      Correct?       Wrong?
        ↓              ↓
       YES        Generate next
        ↓          candidate
      STOP             ↓
                       └──────→ Repeat

---

6. Simple Programming Illustration

We can demonstrate the idea with a harmless toy example where the target is explicitly part of the exercise:

target = "527"

for i in range(1000):
    guess = f"{i:03d}"

    if guess == target:
        print("Found:", guess)
        break

The program systematically generates:

000, 001, 002, ..., 527

and stops when it reaches the target.

This is a good classroom demonstration of exhaustive search without involving an actual login system.

---

7. Why Can Brute Force Become Inefficient?

Consider a password made from a larger character set.

If there are 26 possible characters and the password has length 6:

$$26^6 = 308,915,776$$

possible combinations.

The number becomes much larger when uppercase letters, numbers, and other characters are included.

So:

Short password
      ↓
Few possibilities
      ↓
Brute force may be practical

Long password
      ↓
Huge number of possibilities
      ↓
Brute force becomes impractical

This is an excellent way to introduce students to the relationship between problem size and computational effort.

---

Key Point for Students

Password guessing by brute force is an example of exhaustive search: systematically generate possible solutions, test each one, and stop when the required solution is found.

Remember:

Brute Force = Try every possibility systematically.

This example also gives you a natural transition to the next question in algorithmic thinking:

“Can we solve the same problem without trying every possibility?”

That leads students naturally toward heuristics, pruning, backtracking, and more efficient algorithms.

Python Program for brute force method of password guessing

import itertools
import string

# The actual password we want to guess
password = "abc"

# Define the character set to use (lowercase letters)
characters = string.ascii_lowercase

# Function to perform brute force guessing
def brute_force_password_guess(password, max_length):

    for length in range(1, max_length + 1):
    # Generate all combinations of the current length
        for guess in itertools.product(characters, repeat=length):
            # Join the tuple into a string
            guess = ''.join(guess)
            print(f"Trying password: {guess}")
            if guess == password:
                print(f"Password found: {guess}")
                return guess
    print("Password not found")
    return None


# Set the maximum length to search

max_length = 3

# Call the brute force function

guessed_password = brute_force_password_guess(password, max_length)

Example:You are a software engineer working on a security application for a company that handles sensitive user data. The application has a 4-digit numeric password system for authentication. A user has forgotten their password and it generates system error. Write an algorithm for recovering the 4-digit numeric password. ( University question)

Algorithm: Brute-Force Password Recovery

Objective: Demonstrate a brute-force approach to recover a 4-digit numeric password.

Concept:

• A 4-digit numeric password has $10^4 = 10,000$ possible combinations (from 0000 to 9999).
• The system checks each combination until the correct one is found.

Steps:

1. Initialize Variables:
   • Define the range of passwords (0000 to 9999).
   • Simulate the forgotten password as a target.
2. Iterate Through All Possible Combinations:
   • Loop from 0000 to 9999, comparing each combination with the target password.
3. Check for Match:
   • If the current combination matches the target, stop the loop and return the password.
4. Output the Recovered Password:
   • Display the recovered password and the number of attempts it took.

---

Python Code Example

Here is a simple implementation of the algorithm, designed for demonstration purposes:

# Simulate a forgotten password (target password) 

forgotten_password = 5283 # Example: The actual password 

# Brute-force password recovery 

def recover_password(): 

    print("Starting brute-force password recovery...") 

    for attempt in range(10000): # Iterate through 0000 to 9999 

        if attempt == forgotten_password: # Check if the attempt matches the target 

            print(f"Password recovered: {attempt:04d}") # Format as 4-digit number 

            print(f"Attempts taken: {attempt + 1}") 

  

 recover_password()