Somebody enters your email address and a password into a login form on a site you have never used. The password is not a guess — it is the exact one that leaked from a different site years ago. If you reused it, the login succeeds on the first attempt. That is credential stuffing, and one habit defeats it.
What credential stuffing actually is
When a site is breached, whoever did it walks away with a list of email addresses and passwords, and those lists circulate. Credential stuffing is the replay of those pairs, automatically and at scale, against hundreds of other services: webmail, banks, shops, anything with a login form. The success rate per attempt is a fraction of a percent and need not be higher — millions of attempts still yield thousands of working logins.
Not brute force, and not phishing
The distinction matters because the defences differ. Brute force guesses: it tries password after password against one account, so length defeats it. Phishing tricks: it gets you to type real credentials into a convincing fake, so checking the address bar defeats it. Credential stuffing does neither — it has your real password already and is only checking where else you used it. A thirty-character password used on forty sites is worthless the moment one is breached; a mediocre password used on one site cannot be stuffed anywhere.
Why your email address is the pivot
Passwords are the payload, but your email address makes the attack efficient. One address used everywhere is a perfect join key: anyone holding several breach dumps can line them up into one profile of which services you use and which passwords you favoured. Keep your real address for accounts that matter — bank, primary mailbox, employer. For the forum you posted on once or the shop with a discount code, use an alias or a disposable inbox from our free temporary email service. When that forum is breached, the record holds an address leading nowhere and a password used on nothing else.
How you would notice
Stuffing is quiet, but it leaves traces:
- Sign-in or new-device alerts from services you did not touch, often from an unfamiliar country.
- Two-factor prompts out of nowhere: someone has your password and is waiting for you to tap approve. Repeated prompts at night are MFA fatigue — always deny, then change the password.
- Password reset emails you did not request, especially several in one evening.
- A sudden lockout, or small unexplained charges — cards are often tested with a trivial amount first.
- Mail rules or a forwarding address you did not create — the most serious sign, because someone is reading your reset links.
Fix one: a different password on every site
This single change removes the attack. If nothing is shared, a breach exposes a credential that works at exactly one service — the one already breached, with nothing left to replay. Doing that from memory fails past about five accounts, which is why a password manager is not really optional. Let it generate and store the credentials; you memorise only its master passphrase and your device unlock. If you would rather not adopt one today, at least stop reusing on accounts that matter and generate replacements with our free password generator.
Fix two: a second factor that survives a leak
Unique passwords stop stuffing at the door; a second factor means an exposed password alone is not enough. A passkey is best, bound to the site's real domain and impossible to hand to a lookalike page. A TOTP code from an authenticator app is strong and works nearly everywhere. SMS is weakest: it crosses a phone network where SIM-swap fraud is routine, and a code read aloud to a convincing caller is gone. It still beats nothing. Our online TOTP code generator lets you check authenticator codes first.
Fix three: find out what has already leaked
You cannot prioritise what you cannot see. Check your addresses against known breach data and you will usually surface services you had forgotten about. The breach count is not the point; the passwords are. Any leaked password you reused elsewhere is urgent until it is changed everywhere. Our guide to checking whether your password has leaked covers how to read the results without panicking. Work down by consequence, not by date.
If it already happened
Start with the email account: it holds the reset links for everything else, so securing a bank account while an attacker reads your inbox achieves nothing. Then change the password on the affected account and on every other site where you reused it — that second half is the step people skip, and the reason it recurs. Sign out all sessions and revoke long-lived tokens. Remove recovery addresses and phone numbers you do not recognise, and delete forwarding rules and filters you did not create. Revoke app passwords and connected third-party apps, which often bypass both password and second factor. Finally, confirm 2FA is enrolled to your own device and regenerate its recovery codes.
Length beats symbol soup
The old advice — eight characters with an uppercase, a digit and a symbol — produces passwords that are hard for you and easy for a machine. Length raises the cost of guessing: four or five unrelated words, chosen at random rather than by you, beat P@ssw0rd! and type faster. Against stuffing, uniqueness matters more than either — a leaked thirty-character passphrase is as replayable as a short one. Generate the long ones with our passphrase and password generator, and our post on building a strong passphrase explains how to pick words that are genuinely random rather than merely feeling random.
Briefly, if you run a site
Defending your users is about making automated replay slow and expensive. Rate limit by IP, by account and by the shape of the failures, preferring progressive delays over hard lockouts that can be turned against real users. Screen new passwords against known-breached lists, offer TOTP and passkeys, and put enrolment somewhere obvious. Watch for anomalies: a thin spread of failed logins across thousands of accounts is stuffing, not a forgetful customer. And never let an error reveal which half of the pair was wrong.
A realistic order to work in
You will not fix everything this weekend, so work in the order that reduces damage fastest. Your primary email account first, with a unique password and a strong second factor, because it controls every reset. Then anything with money attached: banking, payment services, marketplaces with a saved card. Then every account where you reused a password. Then the long tail.
One caveat to close on: none of this protects an account whose recovery mailbox is weak. If a service can email a reset link to an old address you no longer control, that address is your real password.
