Credential stuffing is an automated attack in which criminals take username and password pairs leaked in one data breach and try them against other websites. It succeeds because people reuse the same password across many services, so one leaked password can open many accounts. The fix is simple in principle and harder in practice: give every account a unique password, and use throwaway or alias addresses where they genuinely fit.
How Does Credential Stuffing Work?
Most people picture a hacker guessing passwords one at a time. Credential stuffing is different. It is a numbers game played at scale, using lists that already exist.
The typical chain has five stages:
- Obtain a breach list. Large collections of email addresses and passwords circulate after breaches. Some are published openly; others are sold or shared in criminal forums. The list itself is the raw material.
- Clean and format the list. Attackers remove duplicates, sort entries into a consistent format, and sometimes pair email addresses with likely usernames.
- Test against target sites. Automated tools submit the pairs to login pages, often through large numbers of proxy servers or residential IP addresses to avoid rate limits and blocks.
- Filter for hits. Responses that indicate a successful login are separated from failures. Some tools detect success by page content, redirects, or the absence of an error message.
- Exploit the accounts. Working credentials are used to make purchases, send spam, steal data, or resold. Accounts are often checked again later, because a password changed today may be reused again tomorrow.
The defining feature is that no password is cracked. The attacker relies entirely on reuse. If your password on site A is the same as on site B, and site A leaks, site B is exposed without anyone guessing anything.
Why Is Password Reuse the Real Problem?
Credential stuffing is often described as a website security problem, and it is. But the underlying weakness is human behaviour: using the same password in many places. A breach at a single service can therefore cascade across a person's entire online life.
Consider how reuse accumulates. You sign up for a newsletter with your main address and a familiar password. Later you use the same combination for a shopping site, a forum, and a cloud storage account. When the newsletter provider is breached, the list contains an email address and password that now unlocks several other services.
Reuse is not laziness so much as friction. Remembering dozens of strong passwords is difficult, and until recently most browsers and phones made it awkward. Password managers and built-in credential storage have improved, but many people still rely on a handful of remembered passwords.
There is a second, quieter problem: email addresses are reused too. If the same address appears in every breach list, it becomes a stable identifier that links your accounts together. Attackers can see which services you use and target the ones with valuable data or weak login defences. Using a different address for low-stakes signups does not stop credential stuffing on its own, but it reduces the linkage and limits the damage from spam and list correlation.
What Credential Stuffing Looks Like From the Outside
For the person whose account is targeted, credential stuffing often leaves few obvious traces. A successful login may look like a normal session. Signs can include:
- Login alerts from a service you did not use at that moment, especially from an unfamiliar location.
- Password reset emails you did not request, which can mean someone is trying to take over the account.
- Orders, messages, or profile changes you did not make.
- An increase in spam to an address that was previously quiet, suggesting the address has been added to new lists.
For the website, the pattern is different: a spike in failed logins from many IP addresses, followed by a smaller number of successes. Defences include rate limiting, device fingerprinting, bot detection, and checks against known breached password lists. Many services now block passwords that appear in public breach corpora, and some prompt for additional verification when a login looks unusual.
Those defences help, but they are not universal. Smaller sites and older systems may have little protection. That is why the responsibility does not sit only with the platform.
How Do Unique Passwords Break the Chain?
The most effective defence against credential stuffing is to ensure that a password leaked from one site is useless everywhere else. That means a unique password for every account.
A password manager makes this practical. It generates long, random passwords, stores them encrypted, and fills them in. You remember one strong master password, and the manager handles the rest. Built-in browser and phone password managers offer similar convenience, though their security models vary. The important step is to stop choosing passwords yourself for each site.
If you are moving from reused passwords, do not try to change everything at once. Start with the accounts that matter most: email, banking, government services, and any account that can be used to reset others. Your email account deserves particular attention because it is often the recovery route for everything else. If an attacker controls your email, they can reset passwords on many other services.
Turning on two-factor authentication adds a second layer. Even if a password is correct, the attacker needs the second factor. Not all second factors are equal; app-based codes and passkeys are generally stronger than SMS, but any second factor is better than none. Our guide to two-factor authentication explains the trade-offs.
Where Throwaway Addresses Fit — and Where They Don't
Disposable email addresses are sometimes presented as a security tool. They are not a substitute for unique passwords, and they do not prevent credential stuffing by themselves. What they can do is reduce the exposure of your primary address and limit the value of a leaked signup.
If you sign up for a one-off download, a trial, or a forum you may never revisit, a throwaway inbox keeps your main address out of that service's database. If the service is later breached, the leaked address is one you no longer use. That reduces the chance of your primary address appearing in yet another list and makes it harder to link your accounts together.
But disposable addresses have limits. They are receive-only, they expire, and many services block them. You cannot use them for accounts you need to recover later, and you should not use them for banking, government services, or anything tied to your identity. If a service sends a verification code after the inbox has expired, you will be locked out. Our article on whether you can recover a temp mail inbox sets out the honest answer.
The sensible pattern is a spectrum. Use a disposable address for low-stakes, one-time signups where you only need to receive a code or a download link. Use an alias or a dedicated address for services you will keep but do not want tied to your primary inbox. Use your real address, protected by a unique password and two-factor authentication, for anything important.
For signups where you only need to receive a verification code, a temporary inbox can be enough. Our guide to how OTP verification works explains what to expect when codes are sent. If you are weighing disposable addresses against aliases, temp mail vs VPN vs alias compares the trade-offs.
What to Do If You Think You've Been Hit
If you receive a login alert you do not recognise, or a service tells you your credentials appeared in a breach, act quickly.
- Change the password on the affected account immediately. If you reused it elsewhere, change it there too, starting with your email account.
- Check for recovery changes. Look at the account's recovery email, phone number, and connected apps. Attackers often add their own before changing anything else.
- Review recent activity. Look for orders, messages, or settings changes you did not make. Report anything suspicious to the service.
- Turn on two-factor authentication if it is not already on. Prefer an app or passkey over SMS where available.
- Check whether your address appears in known breaches. Services such as Have I Been Pwned let you search by email address. A hit does not mean you were hacked, but it is a prompt to change reused passwords.
If a breach has already exposed your email address, our guide to what to do after a data breach walks through the next steps, including spotting phishing that often follows.
Common Myths About Credential Stuffing
Myth: It only affects big companies. Small sites are often easier targets because they have fewer defences. The attacker does not need to breach the site; they only need to log in with leaked credentials.
Myth: A strong password is enough. A strong password that is reused is still a liability. Strength matters less than uniqueness in this attack.
Myth: Two-factor authentication makes you invulnerable. It raises the bar significantly, but some second factors can be phished or intercepted. Passkeys and app-based codes are stronger than SMS, but none is perfect.
Myth: Disposable email prevents credential stuffing. It does not. It reduces exposure and linkage, but the password is the thing being replayed.
Sources
- NIST Special Publication 800-63B: Digital Identity Guidelines — Authentication and Lifecycle Management (guidance on memorised secrets, breach checks, and authentication assurance).
- OWASP: Credential Stuffing (attack description and defence guidance).
- Have I Been Pwned (search for email addresses in known breaches).
- RFC 6749: The OAuth 2.0 Authorization Framework (definitions of authentication and authorisation flows referenced by many login systems).
In short
Credential stuffing turns one leaked password into many compromised accounts because people reuse passwords. The defence is not a single product but a set of habits: unique passwords stored in a manager, two-factor authentication on important accounts, and a clear-eyed view of where disposable addresses help. Use throwaway inboxes for low-stakes signups where you only need to receive a code; use your real, well-protected address for anything you would be upset to lose. If you want to try a disposable inbox for a one-off signup, MailboxTemp gives you a private address that expires after 60 minutes by default, with extensions available.