Short answer: Credential stuffing is when attackers take username and password pairs leaked from one website’s breach and try them automatically against hundreds of other sites, betting that people reuse passwords. It is not hacking in any meaningful sense — it is bulk guessing with a list that is already correct somewhere. Two-factor authentication defeats it almost completely, because a valid password alone no longer opens anything.
How the attack works
Nothing about it is clever, which is exactly why it works at scale.
- A site gets breached. Some forum, retailer, or app you signed up for years ago and forgot. Its user database ends up for sale, or eventually free.
- The passwords get cracked. If they were stored weakly — and many were — turning hashes back into plaintext is quick.
- The list gets combined. Billions of email-and-password pairs from thousands of breaches are merged into what the trade calls a combo list.
- Bots try them everywhere. Automated tools run those pairs against banks, email providers, retailers, social platforms and streaming services, rotating through proxies to avoid rate limits.
- A small percentage work. Success rates are typically well under one percent. On ten million attempts, that is still tens of thousands of accounts.
Nobody targeted you. You were row 4,318,207 in a file.
Why it succeeds
Password reuse. That is the entire mechanism.
Most people have a small set of passwords they rotate across dozens of accounts, often with predictable variations — a number on the end, a capital letter at the start, the site’s name appended. Modern stuffing tools try those variations automatically.
The uncomfortable arithmetic: if you use the same password on twenty sites, your security across all twenty is set by whichever one has the worst security. And you have no idea which that is.
What it looks like from your side
Signs you are being stuffed right now:
- Login alert emails from services you have not touched in months.
- Verification codes you did not request. This one is important: it means someone has your correct password and is stuck at the second factor. It is not spam — it is an intrusion alarm.
- “Unusual sign-in attempt blocked” notices.
- Password reset emails you did not initiate.
- Account lockouts after too many failed attempts.
People routinely ignore all five. Each one is telling you your credentials are circulating.
Why 2FA is the specific cure
Credential stuffing is automated and volume-driven. Its economics depend on being able to try millions of combinations cheaply and convert a fraction into working logins.
Two-factor authentication breaks that model entirely. A correct password now produces a prompt for a code the bot cannot obtain. There is no way to automate around it — the attacker would have to target you individually, which costs time they are not willing to spend on a random account from a list.
That is why enabling 2FA removes you from the pool almost completely, even though it does not make you immune to targeted attacks. Different threat, different defence — the full picture is in can 2FA be hacked?
One caveat worth stating: SMS-based 2FA still helps here. Credential stuffing bots cannot intercept texts at scale. SMS is weak against targeted attacks like SIM swapping, but against bulk automation it works. Any 2FA beats none — see SMS vs authenticator apps.
What to do about it, in order
- Check what has already leaked. Search your addresses on a breach-notification service. Our guide: how to check if your password has been leaked.
- Turn on 2FA on your email first. It is the reset path for everything else — Google, Microsoft.
- Stop reusing passwords. A password manager makes every password unique without you memorising anything. This is the actual fix for the root cause.
- Prioritise the accounts that matter — email, banking, cloud storage, domain registrar, password manager itself.
- Use passkeys where offered. There is no password to stuff. See passkeys vs 2FA.
- Treat unexpected codes as alarms and change that password immediately.
Related attacks people confuse it with
- Brute force — guessing passwords from scratch against one account. Slow, noisy, and usually blocked by rate limiting.
- Password spraying — trying a handful of very common passwords across many accounts. Designed to avoid lockouts.
- Phishing — persuading you to hand credentials over directly. This one can beat 2FA if the fake page relays your code in real time, which is why phishing-resistant MFA exists.
Credential stuffing is the one where the attacker already has a correct password — just for a different site.
Frequently asked questions
Does credential stuffing mean I was hacked?
No. It means a site you used was breached, and your credentials are now in a list. You were not targeted, and often the original breach was years ago.
How do I know which site leaked my details?
Breach-notification services name the breach when they can. Often you will not know precisely — which is why unique passwords matter more than identifying the culprit.
Is changing my password enough?
Only if you change it everywhere you reused it, to something unique each time. Changing it on one site while twenty others share the old one leaves the exposure open.
Do sites detect and block this?
Large ones try, using rate limits, device fingerprinting and bot detection. Attackers respond with residential proxies and slower attempts. It is an ongoing arms race, and your 2FA does not depend on who is winning.
Are password managers risky since they hold everything?
They concentrate risk, but they solve reuse, which is the bigger problem in practice. Protect the vault with a strong unique master password and its own 2FA. See do password managers get hacked?
I keep getting codes I didn’t request. What should I do?
Change that account’s password now, from a device you trust, and check whether the same password is used elsewhere. The codes are proof someone has the correct password.
The bottom line
Credential stuffing is the most common way ordinary accounts are lost, and it is not personal — it is a spreadsheet and a script. Unique passwords remove the fuel; two-factor authentication removes the payoff. Do both, starting with your email, and an entire category of attack simply stops applying to you.
New to 2FA? Start with our complete guide, or generate a test code with our free browser-based tool.
3 Responses