Definition
Credential stuffing is an automated attack technique where a large list of leaked email-and-password pairs — usually sourced from a previous, unrelated data breach — is systematically tried against the login forms of other services. The attack relies entirely on password reuse: if a person used the same email and password on two different services, and one of those services was breached, the leaked pair can unlock the other.
Why It Works at Scale
Credential stuffing does not require guessing or cracking a password — it uses credentials that are already known to be valid somewhere, betting that a meaningful percentage of people reused the same login elsewhere. Automated tools can attempt millions of these pairs across thousands of sites in a short time, making even a small success rate produce a large number of compromised accounts.
Where Leaked Credentials Come From
Every major data breach that exposes email-password pairs feeds into the pool of credentials attackers use for stuffing attempts. An email address that has appeared in multiple past breaches is disproportionately likely to be included in these lists — see avoiding data breaches with temp email for how limiting an address's breach exposure in the first place reduces this risk.
How to Reduce Exposure to Credential Stuffing
- Never reuse a password across services — a password manager makes unique passwords per account practical.
- Isolate low-stakes signups — a service that never gets a real password or persistent account (using a tempmail with no login) cannot be a target for credential stuffing at all, since there is no credential pair to steal in the first place.
- Enable multi-factor authentication where available — a correct password alone is no longer sufficient to log in even if it is stuffed successfully.
Frequently Asked Questions
Is credential stuffing the same as brute-forcing a password?
No — brute-forcing guesses passwords systematically without prior knowledge. Credential stuffing uses already-known, previously leaked valid credentials, which is far more efficient per attempt.
Can a temp mail address be targeted by credential stuffing?
Only if it has a password associated with it. A standard, no-registration disposable address has no login credential at all, so there is nothing for a stuffing attack to reuse against it.