What Is Credential Stuffing (and How Does It Get Your Accounts)?

Quick answer
Credential stuffing is automated login attempts using username/password pairs stolen from other sites’ breaches.
It works because people reuse passwords: a breach at one site becomes a skeleton key everywhere.
The defense is unique passwords per site plus multi-factor authentication on anything important.

How does credential stuffing work?

A breach leaks username and password pairs — from a forum, a gaming site, a retailer. Attackers take that list and automate logins across thousands of other sites, trying each pair. Because a large share of users reuse passwords, a meaningful fraction of attempts succeed. The attacker then has access to accounts on sites the user never compromised directly. It’s not a hack of your site’s security; it’s the exploitation of password reuse at scale.

Why is it so effective and so cheap?

The inputs are free (breach data circulates openly), the tooling is commodity (open-source stuffing tools with proxy rotation), and the success rate, though low per attempt, is huge in absolute numbers when you try millions. Sites without rate limiting or breach-credential checks are hit especially hard. For defenders it’s a numbers game: you can’t stop the attempts, only make them fail — which is why login rate limiting and blocking known-breached passwords matter.

What can a site do to defend against it?

Four measures that work together. Rate-limit and lock out repeated failed logins per account and per IP. Block passwords found in breach databases — services like Have I Been Pwned’s Pwned Passwords let you check without exposing the password. Enforce or strongly encourage multi-factor authentication, which stops stuffing cold even when credentials are correct. And watch for the signature: bursts of login attempts from rotating proxies at odd hours.

Where this bites vibecoders
The vibecoded login page that accepts any password, with no rate limit and no MFA, is credential-stuffing bait: the AI assistant generates a perfectly functional auth flow and stops there, because attack patterns are exactly the operational detail it doesn’t volunteer. The users who reuse passwords get compromised through a site the attacker never ‘hacked’. Login rate limiting and breach-password blocking are small code changes with outsized impact.

Where AI coding assistants get this wrong

Generating login endpoints with no rate limiting, lockout, or anomaly detection.
Allowing unlimited login attempts per account, making stuffing trivially easy.
No integration with breach-password checks, so ‘123456’ works as a password.
Skipping MFA support entirely on accounts that control sensitive data.

Checklist

Rate-limit login attempts per account and per IP, with lockout after repeated failures.
Block passwords found in breach databases at signup and password change.
Offer and encourage multi-factor authentication on every account.
Monitor for stuffing patterns: proxy-rotated login bursts and unusual geography.

FAQ

What is the difference between credential stuffing and brute force?

Brute force guesses passwords from scratch against one account. Credential stuffing tries already-known username/password pairs from breaches. Stuffing has a much higher success rate per attempt, which is why it’s the dominant attack on login pages today.

Is 2FA enough to stop credential stuffing?

It stops the login part almost completely: even with correct credentials, the attacker can’t produce the second factor. If your site is high-value, make MFA mandatory. Note that some stuffing campaigns also attempt MFA-bypass or phishing, but standard stuffing is neutralized by MFA.