In more detail
Online attacks hit a login form and are slowed by Rate limiting, lockouts and Multi-factor authentication (MFA). Offline attacks work on stolen password hashes at billions of guesses per second, which is why slow, salted hashes matter. Real attackers rarely try every combination in order: they start with leaked password lists and dictionary words with common substitutions, then fall back to pure exhaustive search. The defence is a long, unique password: every extra character multiplies the work. Check yours with the Password Strength & Entropy Auditor.
Why it matters
A password that looks complex can still fall in seconds offline if it is short or follows a pattern. Current guidance (NIST SP 800-63B, OWASP) therefore favours length over composition rules, screening new passwords against breach lists, no forced periodic changes, and slow hashes such as Argon2id or bcrypt with a per-user Salt on the server side.
Example
Assume an offline rig testing 10 billion guesses per second against a fast hash:
| Password type | Possibilities | Worst-case time |
|---|---|---|
| 8 lowercase letters | 26^8 = 208,827,064,576 | about 21 seconds |
| 12 random printable characters | 94^12 ≈ 4.76 × 10^23 | about 1.5 million years |
Common confusion
Credential stuffing replays username/password pairs leaked from another site, and password spraying tries one common password against many accounts. Neither guesses blindly, and both are stopped by unique passwords and MFA, not by password Entropy alone.