I'm new to password cracking and have a conceptual doubt. I understand that tools can generate custom wordlists based on inputs like name, DOB, interests, etc. But I’m confused about the actual cracking process.

Since Instagram (and similar platforms) have strict login attempt limits, how would brute-forcing even work? I read somewhere that if you somehow get the hashed password, you can use tools like Hashcat to crack it offline with your custom wordlist. But in real-world scenarios, how would one even obtain such a hash? Is that something only possible through breaches or malware?

Just trying to understand how this works practically. Not attempting anything illegal — purely educational.