The Brute-Force Approach

By the end you should be able to: Describe the brute-force approach, apply it to the padlock and password examples, and judge when exhaustive search is and is not practical.

Brute force means: generate every possible candidate and test each one until you find the answer.

It is Module 1's trial and error, made systematic. Nothing clever, no insight into the problem — just complete enumeration.

Why it deserves a name

Two genuine strengths:

1. It always works. If a solution exists in the search space, brute force will find it. No approach that prunes candidates can promise that without proof.

2. It is easy to get right. There is no subtle logic to be wrong about, which makes it the natural baseline: solve it by brute force first, and use that to check any cleverer method you write later.

Its weakness is a single number: the size of the search space.

Example 1: the padlock

A 3-dial padlock, each dial 0–9:

10 \times 10 \times 10 = 1{,}000 \text{ combinations}

At 2 seconds per attempt that is about 33 minutes. Tedious, but a person could do it.

Add dials and the space multiplies:

Dials	Combinations	At 2 s each
3	1,000	33 minutes
4	10,000	5.6 hours
6	1,000,000	23 days
8	100,000,000	6.3 years

The method never changed. Only the search space grew — and that alone moved it from practical to impossible.

Example 2: password guessing

Same arithmetic, and the reason password advice is what it is.

For an alphabet of size $a$ and length $L$ , the space is $a^L$ .

Password	Space	At 1 billion guesses/sec
4 digits	$10^4$ = 10,000	instant
6 lower-case letters	$26^6 \approx 3.1 \times 10^8$	under a second
8 lower-case letters	$26^8 \approx 2.1 \times 10^{11}$	~3.5 minutes
8 mixed case + digits + symbols	$\approx 6.1 \times 10^{15}$	~71 days
12 mixed case + digits + symbols	$\approx 4.8 \times 10^{23}$	~15 million years

(Taking a 94-character alphabet: 26 lower, 26 upper, 10 digits, 32 symbols.)

Length matters more than complexity, because length is the exponent. Each extra character multiplies the space by the alphabet size; each extra symbol type only enlarges the base.

This is why brute force is a security concept as much as an algorithmic one — the defence is making the search space too large, not making the method fail.

When brute force is the right choice

The search space is small (a few thousand candidates)
Testing one candidate is cheap
You need a guaranteed answer, not a good-enough one
You are checking a cleverer algorithm against a known-correct baseline
The problem is one-off — an hour of computer time beats a day of your thinking time

When it is not

The space grows exponentially with input size
Each test is expensive
A near-optimal answer would do — then use a heuristic (Module 1)

The connection back to Module 1

Trial and error needed a small search space, cheap testing, and no better information. Brute force is the same three conditions, applied systematically rather than randomly — which guarantees you neither repeat a candidate nor miss one.