What Is Credential Stuffing?

Credential stuffing is an attack where a large set of previously leaked username-and-password pairs — usually breached from an unrelated service — is tried automatically against a different login page, betting that some fraction of users reused the same password across sites.

It's effective at scale because password reuse is common, and the attack requires no guessing: the attacker already has working credentials from somewhere else, and is simply testing where else they might work.

Defending against it requires distinguishing automated, high-velocity login attempts from real users typing their own password, which is exactly what behavioral and device-fingerprint-based detection is built to do — see MaskFlare Radar.