# Credential Stuffing

An attack that automatically tries stolen username-password pairs from one breach across many other websites to find reused logins.

**Credential stuffing[↗](/credential-stuffing)** is an automated attack in which attackers take username and password pairs stolen from one data breach[↗](/data-breach) and try them across many other websites, betting that people have reused the same login elsewhere. Because password reuse is so common, even a small percentage of successful matches can compromise a huge number of accounts.

Credential stuffing attacks are typically run with bots capable of testing thousands of login attempts per minute. Using a unique password for every account, ideally generated and stored by a password manager[↗](/password-manager), completely defeats this attack since a leaked password becomes useless anywhere else.