How did codebreakers beat a machine with 159 quintillion settings?

Nobody beat Enigma by trying every setting. The military version had about 159 quintillion of them, far too many. What cracked it was how the Germans used the machine, plus a flaw built into its design.

The first break came in December 1932 from a Polish mathematician, Marian Rejewski, at the Polish Cipher Bureau. He used permutation group theory and intelligence material obtained from a German spy, Hans-Thilo Schmidt. His opening was a bad habit: until September 1938, operators chose a three-letter message key and enciphered it twice at the start of every message. That repetition created a relation between the first and fourth letters, the second and fifth, and the third and sixth. Rejewski also noticed that lazy clerks often picked starting positions such as AAA, BBB or CCC. Five weeks before World War II began, in late July 1939, the Poles shared their techniques and technology with the French and British.

The British then built on that foundation at Bletchley Park. Enigma's reflector meant that no letter could ever be enciphered to itself, so a codebreaker who guessed a word likely to appear in a message, called a crib, could rule out many positions quickly. Alan Turing exploited this in designing the British bombe, a machine that tested rotor settings against a crib. Even so, the account stresses that good operating procedures, properly enforced, would have made the plugboard Enigma unbreakable to the Allies at that time. Many commentators say the intelligence from these decryptions shortened the war substantially.