What is credential stuffing?
Credential stuffing takes username-and-password pairs leaked from one site and tries them automatically across many others. It requires no password cracking; it exploits reuse. Even a low success rate can be profitable at scale, so attackers move quickly when new credential dumps appear.
- Topic
- Attacks
- Reading time
- 1 min
- Reviewed
On this page
Why this is the attack that actually reaches you
Most people are not singled out by someone cracking their password. They are caught in an automated sweep. A password that is unique to one site stops the stolen pair from working elsewhere, though it does not stop phishing or malware.
What limits the damage
A unique password per site is the primary defence. Two-factor authentication is the secondary one: even a correct password fails without the second factor. Breach monitoring services tell you which credentials to rotate first.
Sources
These primary references support the terminology and current security guidance used in this definition.
