What is a brute-force attack?
A brute-force attack is when someone, or more often a bot, tries a huge number of passwords against your login form until one works. A close cousin, credential stuffing, tries emails and passwords leaked from other websites, because many people reuse them.
Also called: Password guessing, credential stuffing
ON THIS PAGE
What it means
Bots can try hundreds of logins a minute. If your login form accepts every try, a weak or reused password will eventually be found. The attacker doesn't need to be clever, only patient.
The usual defences are simple: slow the attempts down, lock the account for a while after too many failures, and add a second login step so a guessed password alone isn't enough.
Why it matters for vibe-coded apps
AI-built login forms usually check the password correctly but never limit how often it can be tried, so nothing stops a bot from guessing all day.
- Accounts with weak or reused passwords can be taken over.
- A stolen admin account can expose all of your users' data.
- Heavy guessing can also slow your app down for real users.
Example
A login route in an Express app.
app.post("/login", async (req, res) => {
const user = await findUser(req.body.email);
// checks the password, but never counts failed tries
if (!user || !(await verify(req.body.password, user.hash))) {
return res.status(401).send("Wrong email or password");
}
res.json({ token: signToken(user) });
});import rateLimit from "express-rate-limit";
const loginLimiter = rateLimit({ windowMs: 15 * 60 * 1000, limit: 10 });
app.post("/login", loginLimiter, async (req, res) => {
// same checks as before
});Also consider a short lockout after repeated failures on the same account, and two-factor login for admins.
How to check if your app has this problem
- 1Open your login page and enter a wrong password 20 times in a row. If you're never slowed down or blocked, there is no limit.
- 2Search your code for the login route and look for rate limiting or a failed-attempt counter.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Add rate limiting to the login, password reset and sign-up routes.
- 2Lock or slow an account after several failed tries in a row.
- 3Offer two-factor authentication, and require it for admin accounts.
- 4Run a check again to confirm the limit works.
Add brute-force protection to my login, signup and password reset routes. Limit each IP address to 10 attempts per 15 minutes, add a temporary lockout after 5 failed tries on one account, and return the same generic error message every time.
Check if your app has this problem
Paste your website and we'll check for brute-force attack issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- Rate limitingA cap on how many requests someone can make in a set time.
- Two-factor authentication (2FA)A second step at login, like a code from your phone.
- Password hashingStoring passwords scrambled, so even you can't read them.
- User enumerationYour app accidentally reveals which email addresses have accounts.
Need help?
Not sure what this means for your app? Our team will explain it in plain English.