Credential stuffing

Trying leaked username and password pairs against your site en masse.

Attackers take lists of logins stolen from other breaches and try them on a different site, betting that many people reuse the same password.

Automated replay of breached credential pairs to discover valid accounts. A credential pair is a username or email together with its password.

A credential stuffing attack typically works like this:

1. The attacker obtains lists of leaked credentials from earlier breaches.
2. Software tries each pair against the target site's login page, often through many networks to avoid blocks.
3. Pairs that work reveal valid accounts.
4. The attacker takes over those accounts or sells the access.

It differs from related attacks:

• Brute force guesses passwords for one account, trying many combinations.
• Password spraying tries a few common passwords across many accounts.
• Credential stuffing tries real, previously leaked pairs, so each attempt has a good chance of working if the person reused the password.

Credential stuffing sits next to terms that are easy to mix up:

• Account takeover is the result when a credential stuffing attempt succeeds.
• Bot attack describes the automation that runs the attempts.
• Passkey is a login method that has no reusable password to steal.