An offline brute-force attack is password guessing against stolen password hashes or encrypted credential files, without interacting with the live login service. Because the attacker works on copied data, they can try millions of guesses per second and avoid account lockouts, rate limits, and detection controls that normally protect online authentication.
This matters in cyber security because the speed of cracking depends on how the passwords were stored. Strong hashing algorithms, high work factors, unique salts, and encryption of backups all make offline guessing more expensive. Weak password storage turns a data leak into a fast path to account compromise, especially for administrator or service accounts. Defenders reduce this risk by using slow password hashing, protecting backups and exports, limiting who can read stored hashes, and rotating credentials after exposure.