A system for preventing a brute force attack includes an output interface, an input interface, and a processor. An output interface is to provide a workfactor, a challenge token, and a login page to a client. An input interface is to receive a response token, a username, and a password. A processor is to determine whether the response token satisfies a condition based at least in part on the workfactor and determine whether the username and password are valid in the event that it is determined that the response token satisfies the condition based at least in part on the workfactor.