An analyst opens the authentication logs on a Monday morning and finds something odd. There is exactly one failed login for each of six hundred different user accounts, all within a few minutes, all from the same address, and not one account is locked out. Nobody fat-fingered six hundred passwords. Someone tried one password against the whole company and is waiting to see who used it.
Credential attacks target the login itself, and they are common in real intrusions. On the CompTIA Security+ SY0-801 exam they sit under objective 2.5, which expects you to read the indicators, usually an authentication log, and name the attack. This lesson covers online versus offline guessing, dictionary attacks, password spraying, credential stuffing and user enumeration, and the trade-off at the center of every defense: the account lockout.
Online and offline attacks are limited by completely different things
Password guessing comes in two settings, and the difference decides almost everything about how an attack behaves and how you stop it.
An online attack guesses against a live system: it submits usernames and passwords to a login page, a VPN, an RDP service or an API, exactly as a real user would. Every attempt leaves a log entry, and the system can fight back with lockouts, rate limits, CAPTCHAs and multifactor authentication. Online guessing is therefore slow and noisy, which is why smart attackers shape it to stay quiet.
An offline attack guesses against stolen password hashes. Once an attacker has a copy of the hashes, from a breached database or a captured file, all the guessing happens on the attacker's own hardware. There is no login page to rate-limit, no account to lock, and nothing is written to the victim's logs. The attacker can try billions of guesses per second on a rig of GPUs, limited only by how the passwords were stored.
That storage is what decides an offline attack's success, and it ties back to the hashing lesson in the cryptography section. A fast, unsalted hash such as raw MD5 or SHA-1 falls quickly, because the attacker can precompute results and reuse them across every account. A salt, a unique random value mixed into each password before hashing, forces the attacker to attack each hash separately and defeats precomputed rainbow tables. A deliberately slow algorithm built for passwords, such as bcrypt, scrypt, Argon2 or PBKDF2, cuts the guess rate from billions per second to thousands. Stealing hashes is only the start; weak storage is what turns that theft into cracked passwords.
Brute force tries every possibility, while a dictionary tries the likely ones
A pure brute force attack tries every possible combination of characters until one works. It is guaranteed to succeed eventually, but "eventually" grows impossibly fast with length and character variety, which is exactly why length is the most valuable property of a password. Adding one character multiplies the search space by the size of the character set, so a long passphrase beats a short complex password.
Because exhaustive guessing is so slow, real attacks start smarter. A dictionary attack tries a list of likely passwords: common choices such as Password1, leaked passwords from past breaches, words from an ordinary dictionary, and these combined with predictable substitutions and a year or a symbol on the end. Password crackers such as Hashcat and John the Ripper apply rules that mangle each word, turning password into P@ssw0rd, Password!, Password2026 and thousands of other variants. A hybrid attack combines a dictionary with brute-forced endings. In practice most cracked passwords fall to a dictionary with rules, not to pure brute force.
Both techniques apply online and offline, but they look different in each. Against one online account, the indicator is a burst of failures for a single username, often followed by either a lockout or, worse, a success:
4625 Account: jsmith Source: 203.0.113.9 Sub Status: 0xC000006A (bad password)
4625 Account: jsmith Source: 203.0.113.9 Sub Status: 0xC000006A
4625 Account: jsmith Source: 203.0.113.9 Sub Status: 0xC000006A
4740 Account: jsmith (account locked out)
On Windows, event 4625 is a failed logon and event 4740 is an account lockout; a run of 4625s against one account ending in a 4740 is the classic online brute force signature. The failure reason sub-status narrows it down: 0xC000006A means the username was right but the password wrong, while 0xC0000064 means the username does not exist, which hints the attacker is also guessing names. Offline, there are no such logs at all, which is itself the point: if a scenario says the attacker already has the password file, no login-side control is the answer.