Attackers use several techniques to defeat passwords:

• Brute force — trying every combination, where length is the main defense.
• Dictionary attacks — testing common words and lists of millions of leaked passwords.
• Credential stuffing — using passwords from one breach to try other services, exploiting reuse.
• Social engineering — guessing from public details like birthdays and pet names.

A cracking rig with modern GPUs tests billions of combinations per second, so an 8-character lowercase password can fall in seconds.