# Credential stuffing

> Trying passwords leaked from one site on many other sites, at machine speed.

- Level: Intermediate
- Topics: Security
- URL: https://tidbit.legios.com.ar/credential-stuffing/
- In Spanish: [Credential stuffing](https://tidbit.legios.com.ar/es/credential-stuffing/)

**Credential stuffing** takes email and password pairs stolen in one data breach and tries them, automatically, on the login pages of other services: banks, email, shops, streaming. It does not guess anything. It bets on a human habit, using the same password in several places, and with billions of leaked pairs circulating, even a small hit rate means thousands of hijacked accounts.

It differs from a classic brute-force attack, which tries many passwords against one account. Here each account gets one or two attempts, with a password that really was that person's somewhere else. Attackers spread the attempts across thousands of IP addresses through botnets and proxies, so to the website they look like ordinary users who mistyped, which makes simple limits on failed logins far less effective.

For users, the defense is unique passwords for each site, which in practice means a password manager, plus 2FA or passkeys so a leaked password alone is not enough. Services like Have I Been Pwned let you check whether your email appeared in a known leak. Websites fight back by checking new passwords against leak lists, detecting bot traffic, adding a CAPTCHA when something looks off and alerting users about logins from unusual places.

## An analogy

A thief finds a keyring someone lost at the gym and walks around the neighborhood trying those keys on every door. Most fail, but people who use the same key for the house, the car and the office get burgled.

## Keep in mind

- It reuses real leaked passwords instead of guessing new ones.
- It only works because people repeat passwords across sites.
- Bots spread attempts over many IP addresses to look like normal users.
- Unique passwords plus 2FA or passkeys shut it down.

## Go deeper

- [Credential stuffing (OWASP)](https://owasp.org/www-community/attacks/Credential_stuffing)
- [Have I Been Pwned: check if your email was in a breach](https://haveibeenpwned.com/)
- [Credential stuffing on Wikipedia](https://en.wikipedia.org/wiki/Credential_stuffing)

## Related terms

- [Data breach](https://tidbit.legios.com.ar/data-breach/): When private data an organization holds ends up with people who should not have it.
- [Brute-force attack](https://tidbit.legios.com.ar/brute-force-attack/): Breaking into an account by trying passwords, one after another, until one works.
- [IP address](https://tidbit.legios.com.ar/ip-address/): The number that identifies a device on a network, like a postal address.
- [DDoS](https://tidbit.legios.com.ar/ddos/): Knocking a site offline by flooding it with more traffic than it can handle.
- [Proxy](https://tidbit.legios.com.ar/proxy/): A middleman computer that makes requests on someone else's behalf.
- [Website](https://tidbit.legios.com.ar/website/): A set of web pages under one address, stored on a server and opened in a browser.
- [Password manager](https://tidbit.legios.com.ar/password-manager/): An encrypted vault that remembers a different strong password for every site.
- [Two-factor authentication](https://tidbit.legios.com.ar/two-factor-authentication/): A second proof that you are you, so a stolen password alone is not enough.