Credential stuffing is the automated trying of stolen username and password pairs on login forms to gain access to accounts. OWASP says it works when people reuse the same password on more than one site. MITRE lists it as a form of brute force.
- Also Called2other namespassword stuffing · credential stuffing attack
- Related Terms3linked entriesBrute force attack · Account takeover · Leaked credentials
What is credential stuffing?
OWASP defines credential stuffing as the automated injection of stolen username and password pairs into website login forms, in order to fraudulently gain access to user accounts. MITRE describes it as using credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. MITRE lists it as a sub-technique of brute force.
How does credential stuffing work?
OWASP explains that attackers acquire breached credentials and then use automated tools to test them across multiple websites. A match means the person reused a password. The attacker does not need to guess anything. The pairs are already known, and the test is whether they work somewhere new.
Why does it matter?
OWASP calls credential stuffing one of the most common techniques used to take over user accounts. It says attackers can drain accounts, steal sensitive data, run phishing campaigns, or resell valid credentials. The root cause is password reuse, which a single service cannot fully control. This means a breach at one service can put accounts at other services at risk.
How can you detect and reduce it?
OWASP names multi-factor authentication as the primary countermeasure and points to its Credential Stuffing Prevention Cheat Sheet for further protections. MITRE lists these mitigations:
- Set account lockout policies after a certain number of failed login attempts.
- Use multi-factor authentication on externally facing services.
- Follow NIST guidelines when creating password policies.
- Proactively reset accounts that are part of breached credentials.
For detection, MITRE points to multiple failed authentication attempts using different username and password pairs from a single IP address. It also points to rapid login failures across different users from one IP address.
Is credential stuffing the same as brute force?
No. OWASP says brute forcing tries multiple passwords against one or more accounts, which means guessing a password. Credential stuffing typically means using known, breached username and password pairs against other websites.
Related terms
See also brute force attack, account takeover and leaked credentials.
Related pages in the Knowledge Hub
Sources
- OWASP: OWASP defines credential stuffing, says it is one of the most prevalent account takeover techniques, names MFA as the primary countermeasure, and contrasts it with….
- MITRE ATT&CK: MITRE describes credential stuffing, its mitigations (lockout, MFA, NIST password guidelines, resetting breached accounts) and detection ideas.
Also Called.
- Namepassword stuffing
- Namecredential stuffing attack
Questions.
-
What is credential stuffing?
OWASP defines credential stuffing as the automated injection of stolen username and password pairs into website login forms to fraudulently gain access to user accounts. MITRE lists it as a sub-technique of brute force.
-
How does credential stuffing work?
Attackers acquire breached credentials and use automated tools to test them across multiple websites. A match means the person reused a password. The attacker does not need to guess anything.
-
How do you prevent credential stuffing?
OWASP names multi-factor authentication as the primary countermeasure. MITRE also lists account lockout after failed logins, following NIST password guidance, and proactively resetting accounts found in breached credentials.
-
Is credential stuffing the same as brute force?
No. OWASP says brute forcing tries multiple passwords against one or more accounts, which means guessing. Credential stuffing uses known, breached username and password pairs against other websites.
In Our Research
- 1 CISO’s Guide to Account Takeover Prevention: Detection, Response, and Recovery May 2026
- 2 What Is Credential Stuffing? Attackers Don’t Crack Passwords, They Buy Them April 2026
- 3 The Economic Dynamics of Data Trade in the Dark Web: Strategic Insights for SOC Analysts and Incident Response Leads November 2025
- 4 The Hidden Threat of Data Brokers: How Your Brand Is Being Sold June 2025
- 5 Credential Stuffing: Why It’s Still a Major Corporate Threat May 2025
- 6 Building an Internal Cybersecurity Culture: Best Practices and Strategies April 2025