Cybersecurity glossary
What is Credential Stuffing?
Learn what credential stuffing is, how attackers replay breached username/password pairs at scale, how it differs from brute force and spraying, and which defenses stop account takeover.
Definition
Credential stuffing is an automated attack in which adversaries test large lists of stolen username and password pairs against login endpoints, exploiting password reuse to take over accounts that share credentials with breached services.
Why credential stuffing matters
Most people reuse passwords. Attackers know this. After any large breach, credential stuffing turns leaked email-and-password pairs into login attempts against banking, email, retail, SaaS, and corporate SSO portals.
The attack is industrial: botnets, residential proxies, and tooling rotate infrastructure while testing millions of combinations. Each attempt looks like an ordinary POST to /login. When a pair matches, the attacker owns an account without exploiting a software vulnerability.
Stuffing is therefore both a user-hygiene problem and an application-security problem. Unique passwords stop reuse; services still need controls for the users who do not practice that hygiene.
How credential stuffing works
Obtain credential lists
Acquire breached or stolen username/password pairs from dumps, stealer logs, or markets.
Select target login surfaces
Identify web, mobile, and API authentication endpoints that accept the same passwords.
Automate distributed attempts
Bots submit pairs at scale using proxies, browser emulation, and anti-detect tooling.
Filter successful logins
Capture hits where authentication succeeds, often validating sessions or profile access.
Bypass or handle MFA
Where MFA exists, attackers may stop, sell 'valid password' intel, or attempt secondary abuse.
Monetize account access
Fraud, data theft, spam, reseller access, or lateral movement into connected apps.
Stuffing vs brute force vs spraying
| Attack | Primary input | Typical pattern |
|---|---|---|
| Credential stuffing | Known breached pairs | Many unique pairs against one or more services |
| Brute force | Generated or dictionary guesses | Many guesses focused on secrets/OTP fields |
| Password spraying | A few common passwords | Same weak passwords tried across many usernames |
Why basic defenses fail
IP blocklists fail against rotating residential proxies. Simple CAPTCHAs fail against solving services. Uniform lockout on one account does little when each username is tried only a few times. Distinct “invalid user” versus “bad password” messages help attackers validate which emails are registered for later campaigns.
Mobile API endpoints are frequent weak spots: the website may have bot fights while the JSON login used by the app does not.
Defenses that reduce stuffing success
Multi-factor authentication
Block session issuance when password verification alone succeeds, especially for privileged users.
Breached-password protections
Reject or warn on passwords known from breach corpora at signup and password change.
Bot and risk signals
Detect automation via device, behavior, reputation, and impossible-travel features.
Intelligent attempt budgets
Limit by account, credential hash, device, and ASN—not only by raw IP request counts.
- Enforce MFA for users and especially administrators; prefer phishing-resistant methods where possible.
- Monitor distributed login failures and sudden success clusters sharing tooling fingerprints.
- Protect every authentication client equally: web, mobile, partners, and legacy APIs.
- Use consistent authentication error responses to reduce account enumeration value.
- Hash and store passwords modernly so a breach of your own database does not feed the next stuffing wave with plaintext.
- Alert on post-login recovery changes: email, phone, MFA reset, and payout destinations.
- Offer password managers and unique-password guidance in user education, not as the only control.
- Plan response: force step-up, invalidate sessions, and notify users when stuffing campaigns succeed at scale.
Detection clues
Security and fraud teams should correlate authentication telemetry: failure rates by endpoint, geographic dispersion, user-agent entropy, success-after-failure sequences, and overlap with known breach email populations. A quiet stuffing campaign may keep per-account failures low while still producing a profitable number of takeovers.
The practical takeaway
Credential stuffing weaponizes password reuse. Attackers do not need to guess; they replay what other breaches already revealed.
Stop it with layered controls: MFA, breached-password checks, bot management, multi-dimensional rate limits, uniform auth APIs, and monitoring that watches outcomes—not just blocked IPs. For users, unique passwords and MFA remove the economic basis of the attack.
Related security terms
Brute-Force Attack
Guesses candidate secrets rather than replaying known breached pairs.
Password Spraying
Tries a few common passwords across many accounts instead of unique leaked pairs.
Broken Authentication
Broader authentication weaknesses that make stuffing-driven takeover easier.
Multi-Factor Authentication (MFA)
A primary control that blocks many stuffing successes even when passwords match.
CAPTCHA
Friction that can raise bot cost but rarely stops stuffing alone.
Frequently asked questions
What is credential stuffing in simple terms?
Credential stuffing is when attackers take usernames and passwords leaked from one site and try them on other sites. If users reused the same password, the attacker can sign in without guessing.
How is credential stuffing different from brute force?
Brute force invents or enumerates password candidates. Credential stuffing replays known pairs from breaches. Stuffing success depends on password reuse; brute force depends on weak or short secrets and attempt volume.
Where do stuffing lists come from?
Lists typically come from previous breaches, malware stealer logs, phishing kits, and underground markets that aggregate username, email, and password combinations.
Can rate limiting stop credential stuffing?
Per-IP rate limits help only a little because stuffing is often distributed across many addresses. Better defenses combine per-account limits, bot management, breached-password checks, MFA, and anomaly detection.
Does MFA prevent credential stuffing?
MFA greatly reduces account takeover when passwords are reused, but attackers may still identify valid password pairs, target MFA fatigue, or abuse weak recovery flows.
What are signs of a stuffing attack?
Spikes in login failures across many accounts, successes from unusual networks immediately after failures, shared bot fingerprints, and sudden password-reset or email-change activity after successful logins.
Should users care about credential stuffing?
Yes. Unique passwords per site and a password manager remove the reuse that stuffing needs. MFA adds another barrier if a reused password still matches.
References
Explore authoritative guidance and frameworks related to credential stuffing.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.