Which security mechanism is designed to protect against "offline brute-force" attacks?

A token (e.g., hardware token, software token) is used for authentication, often in conjunction with a password, but doesn't directly protect the password hash itself from offline brute-force attacks if the database is stolen.

MFA (Multi-Factor Authentication) adds additional authentication factors to verify a user's identity, making it harder for unauthorized access, but it does not protect stolen password hashes from offline brute-force attacks.

Salting involves adding a unique, random string to a password before hashing it, which prevents attackers from using precomputed rainbow tables to crack multiple passwords simultaneously from a stolen database, thus protecting against offline brute-force attacks.

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is designed to differentiate between human users and bots, primarily preventing automated online attacks like credential stuffing, not offline brute-force attacks against stolen password hashes.