It’s actually pretty difficult still if you’re using secure hashing functions like Argon2 and bcrypt because they’re hard on memory and computational power, meaning brute force attacks are pretty much infeasible, both due to hardware requirements and long hashing times.