Credential stuffing is a popular type of cyberattack where attackers take login credentials and use them on thousands of websites, hoping to fraudulently gain access to people’s accounts. It’s an effective attack, but fortunately, one that’s easy to prevent. 

This article examines credential stuffing in greater detail and explains how you can protect against it.

What is credential stuffing?

A credential-stuffing attack is when an attacker takes people’s usernames, email addresses, and passwords (the credentials) and uses automated tools to inject them into as many sites as possible (the stuffing). In almost all cases, the attackers get these credentials from an earlier attack or a data breach, like the one that affected Dropbox.

How a credential stuffing attack works

The fact that many people suffer from password fatigue is what makes credential stuffing an effective attack. As many as 65% of people(new window) reuse their passwords on multiple accounts, meaning if their passwords ever get exposed in a breach, all those accounts would be at risk. 

For example, if you had an account with an online service using jimmysmith92 as your username and password123 as your password, a credential stuffer would use automated software to try as many other services as possible to see if you used that combination of username and password elsewhere. If so, they get easy access to another account.

Credential stuffing is usually categorized as a brute-force attack (where an attacker uses software to “guess” a password by trying every possible combination of letters and symbols) as it relies on the same principle. Only instead of trying every possible password to access a single service, credential stuffing uses a single password and tries it on every website and service.

The regularity of massive data breaches makes it easy for attackers to perform credential stuffing, and while verifiable numbers are hard to find, the prevalence of reused passwords suggests they’re effective. According to access management firm Okta(new window), 34% of access attempts via its platform are identified as credential-stuffing attacks. 

How to prevent a credential-stuffing attack

As common and successful as they are, there is a surprisingly simple way to protect against credential-stuffing attacks — never reuse your passwords. If you protect every single one of your accounts with a unique and random password, credential stuffing won’t work on any of your accounts — and other brute-force attempts will likely fail, too.

To create strong, random passwords that are almost impossible to crack for most computers, you need to use a password generator. Of course, this leaves the issue of remembering all these new, random passwords, which is nearly impossible for most people.

This is where password managers come in. These are programs that can store passwords for you and then fill them in automatically whenever you need them. There’s no overstating how useful password managers are. They’re a huge upgrade to your digital quality of life, as well as adding to your online security.

How Proton Pass can help

As your password manager contains so much valuable information, it’s a good idea to get one that’s as safe as can be, which is why we developed Proton Pass. Like all Proton products, it uses end-to-end encryption to keep data safe at all times, meaning that even in the unlikely event we do experience a breach, all your data would still be safe.

Proton Pass comes with a built-in password generator, as well as the option to store and autofill passwords and credit cards and even add secure notes. All this information can be shared with friends and family when needed and remain secure.

On top of this, Proton Pass also lets you create email aliases that shield your real email address from marketers and cybercriminals, offering another layer of protection against credential stuffing.

If you would like to be safe from credential stuffing yet also have an easy-to-use password manager that lets you do more than just store passwords, create a free Proton Pass account today.

Protect your passwords
Create a free account

Related articles

People and companies are generally subject to the laws of the country and city where they are located, and those laws can change when they move to a new place. However, the situation becomes more complicated when considering data, which can be subjec
Your online data is no longer just used for ads but also for training AI. Google uses publicly available information to train its AI models, raising concerns over whether AI is even compatible with data protection laws. People are worried companies
iPhone stores passwords in iCloud Keychain, Apple’s built-in password manager. It’s convenient but has some drawbacks. A major issue is that it doesn’t work well with other platforms, making it hard for Apple users to use their passwords and passkeys
There are many reasons you may need to share passwords, bank details, and other highly sensitive information. But we noticed that many people do this via messaging apps or other methods that put your data at risk. In response to the needs of our com
Large language models (LLMs) trained on public datasets can serve a wide range of purposes, from composing blog posts to programming. However, their true potential lies in contextualization, achieved by either fine-tuning the model or enriching its p
is Google Docs secure
Your online data is incredibly valuable, particularly to companies like Google that use it to make money through ads. This, along with Google’s numerous privacy violations, has led many to question the safety of their information and find alternative