According to Cloudflare, credential stuffing attacks represent roughly 34% of all login attempts on the internet. Billions of username/password pairs from past data breaches are freely available in underground forums. Attackers use automated tools to "stuff" these credentials into login forms across thousands of websites — and they succeed far more often than you'd expect.
How credential stuffing works
The attack follows a simple four-step process:
- Obtain a credential list. Billions of email/password pairs from past breaches (LinkedIn 2012, Yahoo 2013, Adobe 2013, Equifax 2017, and thousands more) are available for free or cheap on hacker forums. The Have I Been Pwned database alone contains over 12 billion records.
- Use automated tooling. Tools like OpenBullet, Sentry MBA, or custom scripts send login requests to target websites at massive scale — sometimes millions per hour, using botnets to distribute requests across thousands of IP addresses to evade rate limiting.
- Identify successes. The tool logs every successful login. Success rates of 0.1%–2% are common — which means from a list of 100 million credentials, 100,000–2,000,000 accounts may be compromised.
- Monetize the accounts. Attackers drain loyalty points, steal payment information, make fraudulent purchases, resell accounts on dark web markets, or use compromised accounts to launch further attacks.
Why it works: password reuse
Credential stuffing only succeeds because of password reuse. If every account uses a unique password, a leaked password from Site A cannot be used to compromise Site B.
Studies consistently show that 50–65% of people reuse passwords across multiple accounts. That means for any major breach, roughly half of the leaked credentials will work on at least one other site — often many more.
Real-world scale
- • 2019 Disney+ launch: 10,000+ accounts hijacked on day one via credential stuffing
- • 2020 Nintendo: 160,000 accounts compromised from old Nintendo Network ID database
- • 2022 PayPal: 35,000 accounts accessed using credentials from other breach databases
- • 2023 23andMe: 6.9 million records exposed after 14,000 accounts were stuffed
How it differs from brute force
These are often confused but are fundamentally different attacks:
Brute Force
- • Tries all possible combinations
- • Targets a single account
- • Defeated by long passwords
- • Defeated by lockout policies
Credential Stuffing
- • Uses known email/password pairs
- • Targets millions of accounts
- • Defeated only by unique passwords
- • Partially mitigated by 2FA
The two things that stop credential stuffing
1. Unique passwords for every account
This is the complete solution for individuals. If your password for every site is unique, a breach at one site cannot affect any other. An attacker who gets your LinkedIn password can only access LinkedIn — they have nothing useful to stuff elsewhere.
Use a password generator to create a unique password for every account, and a password manager to store them. This eliminates your personal credential stuffing vulnerability entirely.
2. Two-factor authentication (2FA)
Even if a stuffed credential matches, 2FA stops the attacker from completing the login. They have your email and password but not your second factor. Enable 2FA on every account that supports it, especially email, banking, and shopping accounts.
Note: SMS 2FA is better than nothing but can be defeated by SIM-swapping. Authenticator apps (TOTP) and hardware keys are more secure. See our 2FA guide.
Am I already a victim?
Check haveibeenpwned.com — enter your email address to see if it appears in any known breaches. If your email appears with a breach, change the password on that site and on any site where you used the same password. Use our strength checker to test your new passwords.
Frequently asked questions
How do attackers get so many IP addresses to avoid rate limiting?
They use botnets — networks of thousands of compromised computers and devices (home routers, IoT devices) that each send a small number of requests. The attack appears to come from millions of legitimate IP addresses, making IP-based blocking very difficult.
I use a strong password. Can I still be stuffed?
If your strong password is unique to each site, credential stuffing won't work against you — even if one site is breached, the leaked password is useless on other sites. If you reuse your strong password, it can still be stuffed after a breach.
What should websites do to defend against credential stuffing?
Rate limiting, CAPTCHA, multi-factor authentication, device fingerprinting, bot detection services (Cloudflare Bot Management, Akamai Bot Manager), and monitoring for unusual login patterns. Checking submitted passwords against known breach databases is also effective.
Is checking passwords against breach databases an invasion of privacy?
The NIST SP 800-63B guidelines actually recommend this practice. Services like Have I Been Pwned's Pwned Passwords API use a k-anonymity model — you submit only the first 5 characters of the password hash, so the actual password is never transmitted.