Glossary
What is credential stuffing?
Credential stuffing is an automated attack in which stolen username and password pairs from one breach are tried on many other sites, hoping that people reused them. Each login that works is an account takeover. It succeeds because password reuse is common and because bots can try millions of pairs cheaply.
How it works
Attackers buy or collect lists of leaked credentials. A script then submits each pair to a login form or login API, often spread over many IP addresses so that no single address looks busy. Most attempts fail, but even a small share of hits is enough when the list is large.
It is different from brute forcing. Brute force guesses passwords for one account. Credential stuffing tries known real passwords across many accounts, so each account sees only one or two failed logins.
Why it matters to an online business
- Taken-over accounts are used for fraud, stored value theft, and resale.
- The bot traffic raises infrastructure cost and can slow down real users.
- Support teams handle locked accounts and angry customers.
- Your site can be blamed for a breach that happened somewhere else.
How businesses defend against it
- Ask for a second factor, or a passkey, on sensitive accounts.
- Check new passwords against lists of known breached passwords.
- Limit login attempts per device and per network, not only per account.
- Recognise bots and scripted browsers at the login page.
- Step up verification when a login comes from a device the account has never used.
Where FingerPrint Checker fits
Call FingerPrint Checker from your login endpoint. It returns a device ID and signals for bots, scripted browsers, VPN, proxy and Tor, and rapid use from many networks. Your server can then decide to allow the login, ask for a second factor or refuse it.
Frequently asked questions
How is credential stuffing different from phishing?
Phishing tricks a person into giving up a password. Credential stuffing needs no contact with the victim: it reuses passwords already leaked elsewhere.
Does a strong password stop it?
Only if it is unique to your site. A strong password that was reused on a breached site is still on the attacker list.
Can rate limiting alone stop it?
Rarely. Attackers spread attempts across many addresses, so a limit keyed on IP address or account misses them. Limits keyed on the device are harder to dodge.
Try it on your own sign-up flow
Every new account gets 2,000 free checks. No card required.