Credential Stuffing: Why One Breach Risks Other Accounts
A password stolen from a forgotten website can unlock your email. Credential stuffing explains how, and the fix is simpler than it sounds.
By Siddharth ShankarUpdated October 11, 2026Credential stuffing is the automated testing of stolen username and password pairs on other websites. It works because many people reuse passwords. The defences are a unique password for every account, a password manager, multi-factor authentication or passkeys, and checking passwords against known breach data.
Your email may already be in a known data breach. Find out in about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
Most people think a breach at a company they barely use is someone else's problem. Credential stuffing is the reason it can become yours. The idea is simple, and so is the defense.
What credential stuffing is
OWASP, the open web security community, defines credential stuffing as the automated injection of stolen username and password pairs. It is not guessing. The attacker already has real pairs from earlier breaches and tests them at scale on other sites such as email providers, shops, streaming and banking services.
Why it works
OWASP puts the cause plainly: many users will re-use the same password and username or email. If your password for a small forum was leaked and you also used it for your email, the attacker only needs the forum's leaked list and a tool that tries it elsewhere. They do not need to hack the bigger site.
That is why a breach years ago can still matter. See should you worry about an old data breach.
How an attack unfolds
1. A site is breached, and its credentials are copied. See what a data breach is. 2. The list circulates among criminals, sometimes for years. 3. Automated tools try the pairs on many other sites. 4. Successful logins are used or sold. The attacker may change recovery details, read your email or reset other accounts.
Because the logins use correct credentials, they can look like normal sign-ins to the target site.
Do not guess. See which breaches include your email and what leaked.
Free · About 30 seconds · No sign-up · Email not stored
Signs your accounts may be targeted
- Login alerts from devices or places you do not recognize
- Password reset emails you did not request
- Changes to recovery email or phone details
- Messages sent from your account that you did not write
These can have other causes, but any of them is a reason to secure the account immediately.
What stops it
1Use a unique password for every account
If each password is different, a leak from one site cannot be replayed on another. The NCSC advises using a password manager to create and remember passwords, and suggests three random words as a way to build a password that is hard to crack.
2Add multi-factor authentication
A stolen password alone is not enough when a second factor is required. The NCSC recommends 2-step verification, starting with email.
3Prefer passkeys where offered
The NCSC recommends passkeys over passwords wherever they are available, noting that they resist phishing. Where passkeys are not available, keep strong passwords from a password manager and enable 2-step verification.
4Check passwords against known breaches
Pwned Passwords lets you test a password without sending it in full. The password is hashed locally and only the first five characters of the hash are sent, and the comparison finishes on your side.
5Replace reused passwords starting with the most important accounts
Start with email, banking and any account that can reset others, then work through the rest.
Credential stuffing versus other attacks
Credential stuffing differs from phishing, where you are tricked into handing over a password, and from brute-force guessing, where an attacker tries many passwords for one account. Stuffing uses real pairs from an unrelated leak. Malware-captured credentials, covered in what a stealer log breach is, feed the same lists.
A quick self-check
Ask three questions. Do any two of my accounts share a password? Is my email account protected by its own unique password and a second factor? Have I changed the password at every site named in a breach notice, and at any other site where I used something similar? If the first answer is yes or the second is no, fix those before anything else. The FTC's advice after a breach is to change the password right away for that company and for any account that uses a similar one. A password manager makes unique passwords practical, because you no longer have to remember each one.
Sources
- OWASP: Credential stuffing (stolen username and password pairs tried on other sites)
- NCSC: Passkeys, what you need to know (use passkeys where offered, otherwise strong passwords and 2-step verification)
- Have I Been Pwned: Pwned Passwords (check whether a password appears in breached data)
Frequently asked questions
Does a strong password protect me from credential stuffing?
Only if it is unique. A very strong password that you reuse is still replayed on every site that accepts it.
Does multi-factor authentication stop credential stuffing?
It adds a barrier that a stolen password alone cannot pass. Phishing-resistant methods such as passkeys are stronger than codes that a scammer can talk you into sharing.
Can I tell which breach exposed my password?
Sometimes. Breach-checking tools list the breaches your email appears in and the data types involved. See your email was in a data breach.
Is a password manager safe?
The NCSC recommends them as a way to create and remember passwords. Choose one carefully and protect it with a strong master password and a second factor.
Why would attackers want my low-value accounts?
Because accounts are tested at scale, and an apparently minor account may share a password with something valuable.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Change reused and leaked passwords
NordPass flags weak and reused passwords, and its Premium plan alerts you if your details appear in new breaches.
See NordPass →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.