Credential Stuffing? Explained
Your streaming account suddenly plays shows you never watched, or a shopping site orders things you did not buy — and you never gave anyone your password. Attackers did not guess it; they replayed it. Credential stuffing takes email-and-password pairs stolen from one breach and tries them automatically on hundreds of other sites. Here is how it works and how to become a dead end.
TL;DR / Quick Fix
Quick fix: credential stuffing replays passwords stolen in one breach against other sites, so never reuse passwords. Give every account a unique password with a manager, turn on two-factor for email and banking, and check whether your address appears in known breaches. Unique passwords make stolen lists useless.
Follow these steps
- Learn what stuffing actually is. Attackers load millions of stolen email-password pairs into software that tries them on site after site. It is not guessing — it is replaying. The attack only works where the password was reused.
- See why your 'strong' password did not save you. Strength defeats guessing, not replaying. If the exact pair leaked from any breached site, strength is irrelevant — which is why reuse is the real risk.
- Make every password unique. A password manager generates a different random password per site. One breach then exposes one account, not fifty — the stuffing chain breaks at the first link.
- Add two-factor to high-value accounts. Email, banking, and shopping accounts get a second factor. Even a replayed password fails without the code — compare app vs SMS.
- Check your exposure. Run your email through a breach lookup — see checking for breaches — and change any password tied to a listed breach, starting with reused ones.
- Watch for the warning signs. Unexpected login alerts, password-reset emails you did not request, orders you did not place — treat each as a stuffing attempt and change that password immediately.
What NOT to do
- Do not assume a breach at a 'small' site does not matter. Attackers stuff those pairs into banks and email providers within hours.
- Do not 'fix' it by making one super-password and reusing it everywhere. That is the single most stuffable configuration possible.
- Do not ignore login alerts from unfamiliar locations. They are often the first visible sign of a stuffing attempt succeeding.
- Do not rely on the breached site to warn you. Many breaches surface months later in lookup databases — check proactively.
Frequently asked questions
What is credential stuffing?
An automated attack that tries stolen email-and-password pairs from one breach on many other websites. It succeeds only where the victim reused the password.
How is it different from brute force?
Brute force guesses passwords blindly; stuffing replays known-good pairs. Stuffing is far more effective — which is why unique passwords defeat it completely.
Can two-factor stop credential stuffing?
Yes, on the accounts that have it. The correct password alone is not enough when a second factor is required — another reason to enable it on email and banking.