Attack systematically trying all possible password combinations. Mitigated by account lockouts, rate limiting, CAPTCHA, and strong password requirements.