Offline password guessing is the process of testing large numbers of candidate passwords against captured authentication material, such as password hashes, challenge-response data, or other derived values, without contacting the live service again. Because the attacker works on copied data, the target system does not see repeated login attempts and cannot rate-limit, lock out, or alert on each guess.
This matters in cyber security because a single leak of authentication material can turn into a high-volume password attack. In real incidents, attackers may extract hashes from VPNs, directory services, or management interfaces and then try weak or reused passwords until one works. Defenses focus on preventing capture in the first place with strong protocol design, protecting secrets with salting and modern hashing, limiting exposure of management planes, and using multi-factor authentication so a stolen hash is not enough to log in. If offline guessing is possible, password strength and network isolation become critical controls.