What Is Credential Stuffing? How It Works and How to Stop It

Credential stuffing is an automated attack in which criminals take username-and-password pairs leaked in one website's data breach and run them, often by the thousands per minute, against the login pages of completely different, unrelated sites and apps. It works because so many people reuse the same password across multiple accounts: a password stolen from a forum or retailer breach often opens the door to someone's email, banking, or streaming account too. Unlike brute-force attacks, which guess at passwords, or password spraying, which tries a handful of common passwords across many accounts, credential stuffing only replays credentials that are already known to be real.

What is credential stuffing?

Credential stuffing is the practice of taking lists of usernames and passwords exposed in a data breach at Site A and automatically "stuffing" them into the login form of unrelated Site B, Site C, and so on, to see which ones still work. The Open Web Application Security Project (OWASP) describes it as the "automated injection of stolen username and password pairs" into login forms, carried out with bots or scripts rather than by a person typing credentials in by hand.

The attacker doesn't need to know anything about the victim beyond a leaked email address and password. They don't guess, and they don't need to crack an encrypted password hash — the credentials have already been exposed in plain, readable form (or decrypted) somewhere else on the internet, often in a breach dump traded or sold in criminal marketplaces. The attack's only requirement for success is that the victim reused that same email-and-password combination somewhere else.

How a credential stuffing attack works

A typical credential stuffing campaign follows a predictable sequence:

1. Source the credentials. Attackers obtain large lists of username-password pairs from previous data breaches, phishing campaigns, or malware that harvests saved logins. These lists circulate on dark-web forums, sometimes for free and sometimes for sale.
2. Automate the attempts. Instead of typing each pair in manually, attackers use bots or purpose-built credential-stuffing tools that can submit thousands of login attempts per minute across many target sites.
3. Evade basic defenses. To avoid tripping simple rate limits or IP blocks, the tools often spread requests across large pools of residential proxy IP addresses and rotate browser fingerprints so each attempt looks like it's coming from a different ordinary user.
4. Harvest the hits. Any combination that successfully logs in is flagged as valid. Given how often people reuse passwords, even a low success rate — a fraction of one percent — can still produce thousands of working accounts when the attacker is testing millions of stolen pairs.
5. Monetize the access. Compromised accounts are drained of stored value or loyalty points, used to make fraudulent purchases, mined for personal and financial data, used to send phishing or spam from a trusted identity, or simply resold in bulk to other criminals as "verified" working logins.

OWASP's write-up on the technique traces a well-known real-world example of this chain: credentials exposed in the Sony, Yahoo, and Dropbox breaches of the early 2010s were reused across services because of password reuse, while in the 2014 JPMorgan Chase breach, attackers reportedly used credentials stolen from an unrelated third-party website to get into an employee's account at the bank.

Why password reuse is the real vulnerability

Credential stuffing doesn't exploit a flaw in any single company's systems — it exploits a flaw in human habits. If every account used a completely different password, a breach at one site would be irrelevant to every other account someone holds, because the stolen credentials simply wouldn't work anywhere else. Password reuse is what turns one breach into dozens of potential account takeovers.

This is also why credential stuffing can hit a company with excellent security practices. A retailer can encrypt its database correctly, patch every server, and still see thousands of customer accounts compromised — because the passwords being used against its login page weren't stolen from the retailer at all. They were stolen somewhere else entirely and simply happen to match.

This is precisely the scenario the Federal Trade Commission has warned consumers about: in its 2022 consumer alert following its case against the alcohol-delivery platform Drizly, the FTC explained that a hacker got into the company's systems by reusing a password that had already been exposed in an unrelated breach, and it urged consumers to change not just the exact password involved in any breach notice, but "any other account using a similar one."

Credential stuffing vs. brute force vs. password spraying

These three terms get used interchangeably, but security researchers treat them as distinct techniques, each with a different method and a different giveaway for defenders watching login traffic. For a deeper look at the second technique on its own, see our explainer on brute-force attacks.

CISA's description of password spraying, issued alongside an Australian Cyber Security Centre advisory, frames it as "a type of brute-force attack in which a malicious actor uses a single password against targeted user accounts before moving on to attempt a second password, and so on" — the mirror image of credential stuffing, which fixes the password-username pair and spreads attempts across many sites instead of spreading passwords across many usernames on one site.

Why credential stuffing is a major driver of account takeover

Account takeover — a criminal gaining ongoing control of someone's existing account rather than creating a new fraudulent one — is attractive precisely because the account already looks legitimate to the service provider. It has a transaction history, stored payment methods, saved loyalty points, and the trust of other systems that see it log in. Credential stuffing is one of the most efficient ways to achieve that takeover at scale, because it doesn't require tricking anyone or breaking any encryption; it only requires that the stolen password still works.

That scale is the key difference from a targeted hack. A single breach dump can contain millions of credential pairs, and automated tooling allows an attacker to test all of them against a new target in hours. Because the underlying cause — password reuse — is so widespread, security researchers and regulators alike treat credential stuffing as one of the most persistent sources of account compromise online, independent of how strong any individual company's own defenses are.

Signs a service is under a credential stuffing attack

From the defender's side — whether that's a security team or just an attentive account holder — a few patterns tend to show up when credential stuffing is underway:

• A spike in login attempts with a low success rate. Traffic to the login page jumps sharply, but most attempts fail, because most stolen pairs don't match an actual account on that particular site.
• Logins from unusual or rapidly rotating locations. Because attackers route traffic through large proxy networks, successful and failed logins alike can appear to come from many different countries or IP ranges in a short window.
• One attempt per credential pair, spread across many accounts. Unlike a brute-force attack hammering a single account, credential stuffing traffic typically tries each username-password pair only once or twice before moving to the next one.
• A wave of "new device" or "unusual sign-in" alerts. Users who do get a hit suddenly see sign-in notifications, password-reset emails they didn't request, or unfamiliar devices listed on their account.
• Sudden account-level anomalies after login. Unexpected changes to saved payment methods, shipping addresses, or contact emails shortly after a successful sign-in are a common next step once an account is taken over.

OWASP's Credential Stuffing Prevention Cheat Sheet recommends that organizations watch for these patterns using layered signals — rate limits evaluated over both short and long windows, IP and device reputation, and breached-password screening — rather than relying on any single metric, since attackers deliberately spread requests thin enough to stay under a single fixed threshold.

How to protect your own accounts

Because credential stuffing depends entirely on reused passwords, the individual defenses are straightforward, even if they take some setup:

• Use a unique password for every account. This is the single most effective defense: if no two accounts share a password, a breach anywhere else simply cannot be replayed against your other accounts. See our guide to password managers for how these tools generate and store distinct passwords for you.
• Turn on multi-factor authentication (MFA) everywhere it's offered. CISA's guidance on MFA states plainly that even if an attacker has a correct password, a second factor — a code from an authenticator app, a security key, or a biometric check — blocks them from completing the login. CISA recommends moving toward phishing-resistant MFA built on the FIDO/WebAuthn standard where it's available, since it's harder to defeat than a one-time code.
• Switch to passkeys where a service supports them. Passkeys replace the password entirely with a cryptographic key tied to your device, so there is no shared secret for a credential-stuffing list to contain in the first place.
• Check whether your email has shown up in a known breach. Have I Been Pwned's Pwned Passwords service lets you check whether a password has already appeared in a breach corpus, using a privacy-preserving lookup, so you know which accounts need an urgent password change.
• Act immediately on breach notifications. The FTC's guidance is to change the exposed password right away, plus the password on any other account that uses the same or a similar one — not just the one account named in the notice.
• Watch for the adjacent scams that often follow account takeover, including phishing emails criminals send from a hijacked account.

How services and websites defend against credential stuffing

Consumers aren't the only ones with a role to play. OWASP's prevention guidance recommends that services pair several overlapping controls, since no single one is foolproof on its own:

• Multi-factor authentication as the strongest available control, applied broadly or at minimum for higher-risk accounts and administrators.
• Breached-password screening at signup and login — rejecting passwords already known to be exposed, which is exactly what NIST's SP 800-63B digital identity guidelines instruct verifiers to do by checking new passwords against lists of "passwords obtained from previous breach corpuses."
• Device and connection fingerprinting to flag logins from unrecognized devices or automated clients for extra verification.
• Layered rate limiting across both short and long time windows, since attackers spread requests out specifically to stay under simple thresholds.
• CAPTCHA challenges on risky or unusual logins, used selectively rather than on every attempt.
• IP and proxy reputation checks, applied as graduated friction rather than outright blocking, since legitimate users can share IP ranges too.

What to do now

If you want to meaningfully cut your own exposure to credential stuffing, the highest-impact steps are also the simplest to start today:

1. Install a password manager and let it generate a unique, random password for every account you have — starting with email, banking, and any account with stored payment details.
2. Turn on MFA for your most important accounts first: primary email, financial accounts, and your password manager itself. Choose an authenticator app, security key, or passkey over SMS codes where you have the option.
3. Search your email addresses on Have I Been Pwned and change any password tied to a listed breach, along with any other account using that same or a similar password.
4. Set up breach or new-device alerts where services offer them, so you learn about a suspicious sign-in immediately rather than after damage is done.
5. Never reuse a password you've used anywhere before, even a slightly modified version — modified reused passwords are exactly the kind of pattern credential-stuffing tools and criminals are good at guessing.

Credential stuffing succeeds by betting on human habit, not by beating any particular company's security. Breaking that one habit — password reuse — is what removes the attack's only real point of leverage.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage