Credential stuffing is an automated attack that takes username/password pairs leaked from one breach and tries them against many other websites, relying entirely on the fact that people commonly reuse passwords.
Why it works at scale
Attackers use bots to try millions of leaked credential pairs across many target sites automatically — it doesn’t require guessing anything, just testing already-known, real password/email combinations from unrelated breaches.
Defending against it
- Require multi-factor authentication, which single-handedly defeats most credential stuffing even with a valid password
- Rate-limit and monitor login attempts for unusual patterns (many failed logins across many different accounts from the same source)
- Check user emails against known breach databases and force resets proactively for exposed accounts
- Use CAPTCHA or similar friction on login forms after repeated failures
FAQ
Does rate limiting alone stop credential stuffing?
It slows it down and helps detection, but sophisticated attacks distribute attempts across many IPs specifically to evade simple rate limits — MFA remains the strongest single defense.