How passwords are cracked
Attackers may guess common passwords, reuse leaked credentials, or test candidate combinations offline against stolen password hashes.
Quick answer
Attackers may try credentials reused from breaches, guess likely human patterns, or test candidate passwords against stolen password verifiers. The method depends on whether they target a live login or have obtained verifier data.
Credential stuffing
Credential stuffing tests username and password pairs exposed in one breach against other services. A unique password for every account prevents one leaked password from unlocking unrelated accounts. (OWASP Authentication Cheat Sheet)
Online guessing and offline cracking
Online attempts go through a service, which may limit or detect them. Offline cracking uses stolen password verifiers and can test guesses without contacting the service; a salted, deliberately expensive password-hashing scheme increases the cost of each guess. (NIST SP 800-63B-4) (OWASP Password Storage Cheat Sheet)
What helps protect accounts?
Use unique passwords, enable multifactor authentication, install updates, and change a password when a service reports a breach. Do not reuse a password simply because it looks complex. (NIST SP 800-63B-4)