Brute-force attacks work by computing every possible combination of letters and numbers that could make up a password and then testing it to see if it is correct. The amount of time it takes to find the correct password increases exponentially as the length of the password increases.