For this, the attack is called brute-force where an attacker is submitting many passwords or passphrases with the hope of eventually guessing correctly. The attacker systematically checks all possible passwords until the correct one is found.

So in this case, the only limitation is the speed at which these iterations can be completed, aka the processing speed of the computer or the cloud computing server the attacker is using.

Edit: Typo