Key points
- The credentials usually came from a different breach, phishing campaign, or criminal dataset.
- Credential stuffing is a form of automated account takeover, not proof that the targeted service was breached.
- Unique passwords and password managers break the reuse assumption.
- Rate limits, MFA, bot detection, and breached-password checks provide layered defenses.
How a credential-stuffing attack works
An attacker obtains a list containing email addresses or usernames paired with passwords. Automated tools send those pairs to login endpoints at scale. Successful responses identify reused credentials, after which the attacker can access accounts, steal data, or abuse account privileges. [1]
Attackers distribute requests, imitate normal browsers, and tune attempt rates to evade simple IP blocks. Defenses therefore need account-, device-, network-, and behavior-level signals rather than a single global threshold.
Credential stuffing vs brute force and password spraying
Brute force guesses many possible passwords. Password spraying tries a small set of common passwords across many accounts. Credential stuffing tests pairs already associated with particular identities. The categories can overlap in a campaign, but the distinction matters when describing where the credentials came from and whether the target itself lost them. [1]
Practical defenses
Users should use a password manager to generate a unique password for every service and enable MFA where available. Services can screen new passwords against known-compromised values, rate-limit adaptively, detect automation, notify users of unusual login activity, and protect high-risk actions with fresh authentication.
A PAKE such as OPAQUE reduces the password material a service receives and stores, but it does not make a reused password fail when an attacker submits the correct one. The account-abuse layer remains necessary. [2]
Common questions.
Does credential stuffing mean the targeted company leaked passwords?
No. The credentials are commonly stolen elsewhere and replayed against the target. A successful campaign can affect target accounts without a breach of the target’s password database.
Will changing a reused password help?
Yes, if the replacement is unique and not already compromised. Change it anywhere the old password was reused and review sessions and account activity.
Does MFA stop credential stuffing?
MFA can prevent a correct stolen password from being sufficient, though phishing-resistant methods offer stronger protection than factors that can be intercepted or socially engineered.
Primary sources
Definitions prefer standards bodies, government guidance, and the first-party SealTask architecture. Links open the complete source.
- 01 OWASP: Credential stuffing Definition, distinction from brute force, and common defenses.
- 02 RFC 9807: The OPAQUE Augmented PAKE Protocol The July 2025 OPAQUE specification.
- 03 SealTask: Basecamp credential-stuffing incident record Source-backed first-party record of the 2019 Basecamp credential-stuffing event and its classification.