When discussing passwords, what is considered a brute force attack?

A brute force attack is defined by its systematic, exhaustive enumeration - it attempts every possible combination of characters up to a given length with no reliance on wordlists or precomputed data. Unlike dictionary or rainbow table attacks, it requires no prior knowledge of the password and is theoretically guaranteed to succeed given sufficient time and computational resources.

Threatening or inflicting physical harm to coerce a password is called a rubber hose attack, which is a social engineering and coercion technique, not a cryptographic brute force method.

Loading a list of words into a cracking program describes a dictionary attack, which uses probable passwords rather than exhaustive enumeration of all combinations.

Pre-computing hashes and comparing them to stored password hashes describes a rainbow table attack, which trades disk storage for faster cracking speed.

Waiting for a password to expire is a passive tactic with no active attempt to discover or crack the password.