What is credential stuffing?
Short answer
Credential stuffing is an automated attack where criminals take usernames and passwords leaked from one site and try them on many other sites. It succeeds whenever people reuse passwords, which is why a unique password for every account is so important.
The details
For individuals, the fix is unique passwords and MFA. For website owners, defenses include MFA, rate limiting, bot detection and checking new passwords against lists of known breached passwords, which NIST’s guidance recommends.
Terms explained
- Credential stuffing
- Credential stuffing is an automated attack that tries usernames and passwords leaked from one service against many other services, succeeding wherever people reused passwords.
- Multi-factor authentication
- Multi-factor authentication (MFA) requires two or more kinds of proof to sign in, such as a password plus an app prompt, security key or biometric unlock of a passkey.
Sources
Related questions
Related Guides
GuidePersonal Security
How to Run a Security Scan on iPhone: Step-by-Step Audit
Learn how to run a security scan on iPhone. Audit permissions, verify iOS updates, check compromised passwords, and inspect device profiles.
Read more GuidePersonal Security
7 Signs Your Account Has Been Hacked (and How to Fix It)
Spot the warning signs your account has been hacked, learn immediate containment steps, and restore your digital security with practical defensive advice.
Read more GuidePersonal Security
How to Turn On MFA for Your Most Important Accounts
Learn how to turn on MFA across your email, financial, and business accounts. Follow practical steps to configure authenticator apps and passkeys securely.
Read more GuidePersonal Security
10 Ways to Keep Your Funds Safe on a Crypto Exchange After the Binance Hack Reports
Binance is investigating a suspected hot wallet hack. Here are 10 practical steps to protect crypto held on any exchange: account security, withdrawal limits, self-custody and scam awareness.
Read more