In more detail
Online attacks hit a login form and are slowed by Rate limiting, lockouts and Multi-factor authentication (MFA). Offline attacks work on stolen password hashes at billions of guesses per second, which is why slow, salted hashes matter. The defence is a long, unique password: every extra character multiplies the work. Check yours with the Password Strength & Entropy Auditor.