What is credential stuffing, and how do you stop it?

Credential stuffing is an attack in which bots try username and password pairs stolen from one site on the login forms of other sites. It works because many people reuse the same login across services. Every pair that still works hands over an account. The main defenses are multi-factor authentication, checks against breached passwords, and limits on failed logins per account and per network.

#How does credential stuffing work?

1. A site is breached, and its usernames and passwords end up in attackers' hands.
2. Attackers load the pairs into a bot that submits them to another site's login form (OWASP OAT-008).
3. The bot spreads its attempts over many IP addresses, so no single address trips a limit.
4. Pairs that work are confirmed and passed on, often in public posts.

The last step leaves a trail. In January 2022, New York's Attorney General reported credentials for more than 1.1 million customer accounts at 17 companies. All of them appeared to have been compromised in credential stuffing attacks. In December 2023, 23andMe told the SEC that attackers had reached 0.1 percent of its user accounts with reused logins.

#Is credential stuffing the same as brute force?

OWASP counts credential stuffing as a subset of brute force, and it defines the three password attacks side by side.

#Where does credential stuffing traffic come from?

FFraud's open data lists 77,801 addresses whose worst confirmed abuse is brute force, out of 1,580,496 (build of October 23, 2026). A random sample of 200 of them was looked up through the API that morning. Of these, 147 carried a login brute-force tag, the signal of credential stuffing, and 103 an SSH brute-force tag.

Four in five came from home connections, and only 14 of the 200 carried a proxy, VPN or Tor flag. Home addresses in attacks are often compromised devices: the FBI counted over 19 million compromised IP addresses in one residential proxy botnet, 911 S5. A rule that blocks only data centers and anonymizers would have missed most of this traffic.

OWASP draws the same conclusion. Its prevention guide says IP blocking "should not be used as the sole or primary defense". It recommends checking logins against proxy data and hosting ranges instead.

#How do you detect and stop credential stuffing?

• Multi-factor authentication. OWASP calls it "by far the best defense", citing Microsoft's estimate that it would have stopped 99.9 percent of account compromises.
• Breached-password checks. NIST SP 800-63B requires checking new passwords against a list of known compromised ones. A range search sends only the first five characters of the password's SHA-1 hash.
• Limits per account. NIST caps consecutive failed attempts on one account at 100 before the authenticator is disabled.
• Limits per network. Count failures per /24 and per ASN as well as per address, because stuffing spreads over many addresses.
• IP risk at login. Score the address of each login. Ask for a second factor when it has abuse history or the device is new.

OWASP's signs of an attack in progress include one address trying many accounts and addresses on denylists or tied to anonymizers. The two checks below run in a login handler: one against breached passwords, one against the reputation of the address.

import crypto from "node:crypto";

// 1. Is this password in a known breach? Only 5 hash characters leave your server.
async function isBreached(password) {
  const sha1 = crypto.createHash("sha1").update(password).digest("hex").toUpperCase();
  const res = await fetch(`https://api.pwnedpasswords.com/range/${sha1.slice(0, 5)}`);
  const body = await res.text();
  return body.split("\n").some((line) => line.startsWith(sha1.slice(5)));
}

// 2. What has the login's address been caught doing?
async function ipRisk(ip) {
  const res = await fetch(`https://api.ffraud.com/public/ip/${ip}`);
  const data = await res.json();
  const stuffing = (data.threat_tags ?? []).includes("login_brute_force");
  if (data.risk === "critical" || (data.risk === "high" && data.recent_abuse)) return "block";
  if (data.risk === "medium" || data.risk === "high" || stuffing) return "ask for a second factor";
  return "allow";
}

The decision follows FFraud's score bands: block critical, and high with recent abuse; ask for a second factor on medium and high.

#Questions people ask

To see an address's brute-force history before a login goes through, check it with the free IP reputation check.