Online vs Offline Password Attacks (Why Rate Limits Don’t Save You)
Many password policies focus on stopping login abuse. While this matters, most real-world compromises happen in a completely different environment — after attackers already possess password data.
Online Attacks: Limited by Design
Online attacks target live login systems. Attackers must interact directly with authentication endpoints and are constrained by defensive controls.
- Rate limiting
- Account lockouts
- Monitoring and alerts
Because each attempt is slow and observable, online attacks are usually noisy and short-lived.
Offline Attacks: Where Passwords Actually Fail
Offline attacks occur after a breach, when attackers obtain password hashes. At this point, all login protections disappear.
- No rate limits
- No lockouts
- Millions or billions of guesses per second
This is why passwords that survive years of login attempts can fall quickly once hashes are stolen.
Why Treating These Attacks the Same Is a Mistake
Controls that work well online do nothing offline. Strong rate limiting does not slow a stolen hash.
Offline resistance depends primarily on:
- Password length
- Hashing algorithm speed
- Attacker hardware