What Is Credential Stuffing? One Leak, Every Account

One leaked password can open every account where you reused it. That attack has a name: credential stuffing.

It does not depend on the leaked password being weak. It depends on the same password being used in more than one place.

What credential stuffing is

Credential stuffing is testing username and password pairs obtained from the breach of another site.

Attackers take a pair from a breach at one site and test it at other sites. The pair is the combination for that account: a username and the password that goes with it.

The testing is automated. OWASP treats credential stuffing login attempts as scripted or bot activity, not as a person typing each pair in by hand.

That is the whole method. A pair is taken from one place and tried in other places, automatically, to see whether it opens another account.

Why password reuse makes it work

Credential stuffing relies on the re-use of passwords between multiple sites. It also relies on the re-use of usernames.

Most users have a single email address they use for all their accounts. OWASP makes the point directly: that makes the combination of an email address and a password very effective for these attacks.

CISA puts the reuse risk plainly. Reusing a password, even a strong one, endangers your accounts. If attackers get your password, they would have access to your other accounts with the same password.

So the condition that makes this work is simple. The same email and the same password open more than one account. When that is true, one match can give access to another account, even though the second account was not the one that was breached.

A unique password for every account breaks the chain

Use different passwords on different systems and accounts. That is CISA’s rule, and it is the direct break in this chain.

If every account has its own password, a password leaked from one site opens nothing else. The pair from that breach has nowhere else to work, because no other account uses that password.

A strong password that is reused does not give you that break. Strength helps an account on its own. Reuse is the separate problem, and reuse is what credential stuffing needs.

Start where the risk joins up. Your email account uses the same email address that names your other accounts, so it is the first account to give its own password.

How to stay safe

Give every account a unique password. Do not reuse a password from one account on another account, and do not treat a strong reused password as safe.

Use a password manager to make that practical. CISA describes what a password manager does: it generates, stores, and fills in all your passwords, and it tells you when you have weak or re-used passwords. With a password manager, you are much more likely to use a long, random, and unique password on every site, and you only need to remember one strong password — the one for the password manager itself. For the full guide, see password managers.

Add multi-factor authentication where you can. Multi-factor authentication means using more than a password to access an account, so a stolen password alone is not enough. CISA names the priority accounts directly: enable multi-factor authentication especially for your email, social media accounts, and financial accounts. Where a passkey is available, you can use a passkey instead — see passkeys explained. If sign-in prompts themselves are the risk you are dealing with, see also MFA fatigue.

Do the first fix today. Change one reused password — start with your email — and turn on multi-factor authentication there.

If you already did it

In this topic, "already did it" means you already reused a password: the same password is in use on more than one account.

Work the sourced fix, in this order. Change the reused passwords so that each account gets its own password. Start with your email account, then change the other accounts where that same password was used.

Make each replacement unique to that account. Do not give the new password to any other account, or the same chain is in place again.

Use a password manager for the replacements. Let it generate, store, and fill long, random, unique passwords, and use its warnings about weak or re-used passwords to find the accounts you still need to fix.

Then add the second step. Turn on multi-factor authentication where you can, or use a passkey where available, so a stolen password alone is not enough to open the account. If an account is already out of reach, see account recovery.

Sources: OWASP Cheat Sheet Series — Credential Stuffing Prevention ↗ · CISA — Use Strong Passwords ↗ · CISA — Choosing and Protecting Passwords ↗