Trying out all possible combinations of characters until the “correct answer” is found. This process can take a very long time, so dictionaries and lists of common passwords like “qwerty” or “123456” are usually used.
We use Have I Been Pwned, a reputable service that collects information about account and password leaks.