I looked up a bunch of websites online, and answers vary from 3-5 (https://hypixel.net/threads/minecraft-maximum-attack-range.180414/). Some say client side is 3 blocks and server side is 6, so it can vary between 3-6 (https://www.spigotmc.org/threads/anyone-know-the-maximum-hit-distance.245846/).

From my experience, on all servers I played on (12+), my anecdotal data is averaging 2-3 blocks, with 3 probably being the maximum. But I haven’t done an experiment with a player standing still, asking them their F3 coordinates, and comparing them with my F3 coordinates while making sure I’m able to hit them, and then subtracting the difference to find the distance I can hit them at. I would think that would be the most accurate way to measure it and probably include ping at current time just in case that becomes a variable.