Which is more likely to occur, and by how much: getting your password stolen, or getting your account hacked by brute-force?

  • 3
    If you count db breaches as stolen, stolen, far and away more common.
    – dandavis
    Oct 31, 2017 at 23:51
  • 1
    device accounts? online accounts? service accounts?
    – schroeder
    Nov 1, 2017 at 16:44

3 Answers 3


Your request isn't very precise, so it's not clear what kind of data will best answer your question. However, a good place for you to look would be on PasswordResearch.com, where many studies pertaining to passwords and breaches have taken place. This link will take you to a list of statistics about criminal activity involving authentication.


This question is badly designed. Obviously if you're using a stupid/overly short pass like "qwerty" expect to be brute-forced or guessed. Standard practice among hackers includes a list of the most common ones used and they run through that list before alphabetic brute force.

If the end-user isn't a complete idiot, brute-force and guessing become increasingly unlikely and the major threats are:

Client-side keylogger malware, usually downloaded by a malicious script attached to a website or email attachment or included as a trojan in a larger program.

Server-side shenanigans. Even if you're 100% perfect at protecting your computers, there's always the chance that someone at the server end failed to patch vulnerable software (**cough cough* Equifax **cough*), downloaded a keylogger/malware that steals server DB admin logins, or clicked on a phishing email and compromised the network.


It depends entirely on your password and/or how likely you are to be targeted. If you use a weak password that is easily susceptible to guessing, you are likely to be compromised in this way as basic dictionary attacks are run at a low level constantly.

If, however, you use a secure, long password, it rapidly becomes impractical to brute force the password directly. Password theft, however, is not the only way to compromise an account. It is possible that accounts may be compromised without the password directly via a number of different types of attacks, so password theft isn't the only problem other than brute force that has to be worried about.

Attacks like cross site scripting can attempt to make legitimate users take illegitimate actions or attackers may simply attempt to hijack the legitimate session of a user. These don't require access to the password to make use of the account.

Good password selection will prevent brute forcing, but password theft isn't the only threat to worry about. It also is important to realize that bulk data breaches regularly compromise either direct passwords or password hashes (sometimes weak hashes) so it's really important to use long and unique passwords for your accounts.

Not the answer you're looking for? Browse other questions tagged or ask your own question.