In authentication, candidates can be checked online by a service or offline against captured password verifiers or encrypted material. The term is an umbrella for strategies such as concentrated password guessing, password spraying, and credential stuffing, even though their candidate sources and account distributions differ.
Online attempts create verifier events and may be distributed to avoid simple thresholds. Offline attempts occur after protected material is obtained and create no sign-in failures, so protections and evidence differ.
Key points
Candidate patternsMany candidates may be tested against one account, a small candidate set across many accounts, or exposed credential pairs against other services; each pattern changes detection and lockout risk.
EvidenceCorrelate failures and successes across accounts, sources, devices, services, and time, while checking for account discovery, password-verifier theft, recovery abuse, and activity after a successful sign-in.
Risk reductionUse phishing-resistant multi-factor authentication (MFA) where appropriate, reject compromised passwords, protect stored verifiers with suitable password hashing, rate-limit attempts, and design recovery and alerting for abuse.
Important limitationRate limits and account lockouts do not stop offline attacks and can be evaded by low-rate or distributed attempts. Overly aggressive lockout can also deny service to legitimate users, while a successful login does not reveal how the credential was obtained.