Definition
Credential stuffing is an automated attack that tries usernames and passwords leaked from one service on many others, betting that people reuse the same password.
What credential stuffing is
Credential stuffing is an attack in which criminals take usernames and passwords leaked from one website and try them automatically on many others. It works because people reuse the same password across different services, so a password stolen from a small forum can open an email account, an online shop or a company VPN.
The attacker does not need to guess anything. They already have real credentials, often millions of them, and simply test where else they work.
How credential stuffing works
- Collect credentials. Attackers buy or download lists of email and password pairs from past data breaches. These lists are widely traded and often combined into huge collections.
- Automate the logins. Bots or ready-made tools submit the credentials to a target's login page or API at high speed.
- Avoid detection. Requests are spread across many IP addresses, often through proxies or residential networks, so they look like normal users from different places.
- Record what works. Successful logins are saved. Even a small success rate means thousands of working accounts when the list is large.
- Use or sell the access. Working accounts are used for fraud, data theft or further attacks, or sold to other criminals.
Credential stuffing vs brute force vs password spraying
All three try to get into accounts by logging in, but in different ways:
| Attack | How it works | Example |
|---|---|---|
| Credential stuffing | Tries real username and password pairs leaked from other sites | A leaked pair from a shopping site tried on a bank login |
| Brute force | Tries many passwords against one account | Thousands of guesses against one admin account |
| Password spraying | Tries a few common passwords against many accounts | "Spring2026!" tried once against every employee account |
Brute force and password spraying guess. Credential stuffing uses passwords that were already real, which is why it can succeed with far fewer attempts per account.
Why credential stuffing works
- Password reuse: many people use the same or similar passwords on several sites
- Huge leaked datasets: billions of credentials from past breaches are freely available
- Cheap automation: tools and bot services make large-scale attacks easy and inexpensive
- Hard to tell apart from real users: each login attempt uses a valid username and comes from a different address
- Accounts without MFA: a correct password is all that stands between the attacker and the account
The impact of credential stuffing
- Account takeover: attackers log in as real customers or employees
- Fraud: stolen payment details, loyalty points, gift cards or orders placed on someone else's account
- Data exposure: personal data in the account is viewed or copied
- A foothold in the company: a reused password on a VPN, email or SSO account can give an attacker a way into the corporate network, the start of an attack path
- Operational cost: locked accounts, support calls, password resets and load on login systems
- Reputation and compliance: customers lose trust, and exposed personal data can trigger reporting duties
Signs of a credential stuffing attack
- A sudden spike in failed logins, often across many different accounts
- Login attempts from unusual locations, networks or large ranges of IP addresses
- Many attempts for usernames that do not exist on your service
- Successful logins followed by quick changes to email, password or payment details
- Unusual traffic to login APIs, especially from scripts rather than browsers
How to prevent credential stuffing
For organisations
- Require multi-factor authentication, especially for remote access, email, admin accounts and anything with sensitive data.
- Check passwords against known breaches at sign-up and password change, and block those that have already leaked.
- Rate-limit and monitor logins per account, per IP and per device, and alert on unusual patterns.
- Use bot detection to tell automated login attempts from real users without making it hard for customers.
- Move towards passwordless sign-in, such as passkeys, where it is practical.
- Protect corporate accounts with SSO and conditional access, so one policy covers every application.
- Test your login defences to confirm that MFA, rate limits and lockouts actually work on every exposed login.
For users
- Use a different password for every account, stored in a password manager
- Turn on multi-factor authentication wherever it is offered
- Change passwords quickly when a service you use reports a breach
How Plainsea helps
Credential stuffing succeeds where login defences are weak. Within the scope you set, Plainsea looks for exposed login pages, remote access services and APIs, and checks whether they are protected by MFA, rate limits and lockouts. When a test finds credentials, AI agents check where else they work, the way an attacker would after a breach, and show what that access leads to. Every finding is confirmed before it reaches your team and can be re-tested on demand.