Signing in.
Any password is accepted, however short. What protects it is that guessing is limited to a few tries before this address has to wait.