# What is Credential stuffing?

> Automatically replaying email and password pairs stolen from one breach against many other services.

Last reviewed: 2026-09-01

## Credential stuffing

Category: Attacks

Canonical page: https://moolkey.com/glossary/credential-stuffing

Credential stuffing takes username-and-password pairs leaked from one site and tries them automatically across many others. It requires no password cracking; it exploits reuse. Even a low success rate can be profitable at scale, so attackers move quickly when new credential dumps appear.

### Why this is the attack that actually reaches you

Most people are not singled out by someone cracking their password. They are caught in an automated sweep. A password that is unique to one site stops the stolen pair from working elsewhere, though it does not stop phishing or malware.

### What limits the damage

A unique password per site is the primary defence. Two-factor authentication is the secondary one: even a correct password fails without the second factor. Breach monitoring services tell you which credentials to rotate first.

### Sources

- [OWASP: Credential Stuffing Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html): How password reuse is replayed at scale and how services can limit the damage.
- [CISA: Secure Our World](https://www.cisa.gov/secure-our-world): Public guidance for recognizing phishing and protecting high-value accounts.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.