Credential Stuffing

Credential stuffing is an attack where bots test large lists of leaked username and password pairs against other services, hoping people reused the same login.

Why it matters

It works because password reuse is common, and success rates need only be small when millions of attempts are cheap. Defenses include MFA, rate limiting and bot detection, screening passwords against known breached lists, and alerting users to suspicious logins. Users protect themselves with unique passwords from a manager.

Example

A forum is breached and its email and password pairs are published. Days later a bank sees thousands of login attempts from many IPs using those exact pairs, and the accounts whose owners reused the password are taken over.

Common mistakes

• Confusing it with brute force. The passwords are real, previously leaked ones.
• Blocking by single IP only, when attackers rotate through botnets.
• Not offering MFA to customers.

Related

• Brute force attack
• Botnet
• Password manager
• Rate limiting

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.