The Myth: "My Password Is Strong, So I'm Fine"
This is the single most common misconception in account security, and it's worth debunking directly before anything else. A long, complex, genuinely uncrackable password protects you against exactly one thing: someone trying to guess it. It does nothing at all against an attacker who already has the correct password in hand, typed correctly, from a leak somewhere else. That second scenario is credential stuffing, and it doesn't care how strong your password is. It only cares whether you used it twice.
How Leaked Credentials Actually Circulate
Somewhere right now, a botnet is testing millions of email and password pairs against Netflix, PayPal, banks, and retailers, not guessing them, replaying them. Every pair started life as a genuine breach: a forum, an old retailer, a fitness app, some service you signed up for once in 2016 and forgot existed. When that service gets hacked, its user database, emails paired with passwords, sometimes hashed weakly enough to crack, sometimes stored in plain text outright, ends up for sale or free distribution on criminal forums.
These individual breach dumps don't stay isolated. They get merged, deduplicated, and compiled into master lists that stack on top of each other for years. Compilations circulating publicly have exceeded 20 billion combined credential records, folding together LinkedIn's 2012 breach, Adobe's 2013 breach, the 2019 "Collection #1" dump, and hundreds of smaller incidents nobody outside security circles ever heard about. An old password doesn't expire from these lists. It sits there indefinitely, useful for as long as anyone, anywhere, keeps using it.
The Automated Machinery Behind The Attack
Testing billions of credential pairs by hand is obviously impossible, so the entire operation runs on purpose-built tools, credential stuffing software like OpenBullet or SNIPR, that are traded openly in criminal communities alongside "config files" tuned for specific target websites. These tools:
- Load a breach list and a target site's login endpoint automatically.
- Rotate requests across thousands of residential proxy IP addresses to dodge rate limiting and IP-based blocking.
- Mimic real browser behavior, headers, timing, even mouse movement patterns, to slip past basic bot detection.
- Log every successful login automatically, sorted and ready for sale or immediate use.
Success rates on a given list typically run between roughly 0.1 percent and 2 percent, numbers that sound negligible until multiplied against lists containing hundreds of millions of rows. A 0.5 percent hit rate against 200 million credential pairs is a million working logins, harvested automatically, overnight, for the cost of some proxy bandwidth. A working Netflix or streaming login resells for a dollar or two on dedicated marketplaces. A working bank or crypto exchange login is worth dramatically more. And a working email login is often worth the most of all, since email access unlocks password resets across everything else that account touches.
Credential Stuffing Is Not Brute Forcing, and the Difference Matters
The two get confused constantly, but they represent opposite attack philosophies, and knowing which one you're actually defending against changes what defense works.
| Aspect | Credential Stuffing | Brute Force |
|---|---|---|
| Where the password comes from | Real passwords leaked from other breaches | Systematically generated guesses |
| Attempts needed per account | Usually just one, the real one | Potentially thousands to billions |
| Stopped by a longer, more complex password | No, the correct password is already known | Yes, dramatically |
| Stopped by a unique, never-reused password | Yes, completely and immediately | Not directly relevant |
| Stopped by 2FA | Yes | Yes |
Look closely at that third row. Password strength, entropy, length, symbol variety, all of it, is entirely irrelevant against credential stuffing, because the attacker isn't computing anything. They're presenting the actual password back to you, character for character, exactly as it was leaked. A forty-character randomly generated masterpiece reused on two sites is precisely as vulnerable as "123456" the moment one of those two sites gets breached. Our companion piece on brute force attacks covers the guessing-based cousin of this attack in more depth.
Checking Whether You're Already Exposed
- Visit haveibeenpwned.com and enter your email address. Most people with more than a decade of internet accounts show up in several breaches, often ones they've completely forgotten signing up for.
- A listing doesn't mean any current account is actively compromised today. It means precisely one thing: any password you ever used on that specific breached site must never be used anywhere, ever again, starting immediately.
- Modern browsers and password managers increasingly flag reused and known-breached passwords automatically as you type them. Treat that warning as an instruction, not a suggestion.
The mental shift that actually matters here: a password isn't compromised the day someone attacks your account with it. It was compromised the day the single weakest, most forgettable site you ever reused it on got breached, however long ago that was.
The Two Fixes That End This Completely
1. A Genuinely Unique Password Per Site
Credential stuffing dies instantly against unique passwords, full stop. A leaked forum password only ever unlocks that forum, nothing else, because it was never typed anywhere else to begin with. Nobody can realistically memorize two hundred unique passwords, which is exactly why a password manager exists to generate and store them for you. Our free password generator creates cryptographically random passwords entirely in your browser, and the strength checker shows roughly how long each one would survive a cracking attempt, useful for the smaller number of passwords you do need to remember. For the master password protecting your password manager itself, see our passphrase guide.
2. Two-Factor Authentication As The Backstop
2FA makes a correct, valid, perfectly leaked password insufficient on its own. The bot presents your real credentials, gets a code prompt it has no way to answer, and moves on to a softer target elsewhere on the list. Since you have no control over when the next unrelated site you signed up for years ago gets breached, this backstop matters regardless of how careful you are going forward. Start with email and financial accounts specifically: our 2FA beginner guide covers setup in a few minutes, and our free TOTP generator demonstrates exactly how the codes work.
Frequently Asked Questions
How do attackers end up with billions of real passwords in the first place?
Pure accumulation over more than a decade. Every individual breach, LinkedIn in 2012, Adobe in 2013, Collection #1 in 2019, and hundreds of smaller incidents in between, adds more rows to lists that never expire, because people keep old, breached passwords alive by reusing them for years afterward. The compilations get merged, deduplicated, and sorted by estimated target value on criminal marketplaces.
My password is genuinely strong. Does that protect me from credential stuffing?
Only if it's also unique to that one site. Strength defends against guessing attacks; stuffing doesn't guess at all. The attack simply presents your actual, correct password back to a login form, however strong it is, wherever you happened to reuse it.
If sites can detect bot logins, why does this attack still work at all?
Sites do fight back hard, rate limiting, CAPTCHAs, device fingerprinting, and login anomaly detection all try to catch this traffic. Attackers respond with residential proxy networks and browser automation that mimics real human behavior closely enough to slip through often enough to stay profitable at scale. Your unique passwords remove you from the equation entirely, regardless of which side is currently winning that particular arms race.
I got an email claiming my password appeared in a breach. Is that legitimate or a scam?
Both exist side by side. Notifications from your browser, your password manager, or haveibeenpwned itself are legitimate and worth acting on immediately. Emails demanding you "click here to secure your account right now" may be phishing riding on the exact same fear. Never log in through the email's link. Go to the actual site directly and change the password there instead. Our phishing guide covers telling the two apart in more detail.
What about accounts on sites I've completely forgotten I ever used?
Forgotten accounts with reused passwords are exactly the kind of entry credential stuffing lists monetize best, precisely because nobody's watching them. When a breach notice mentions a site you barely remember, the reused password is the real, live risk, not the dormant account itself. Rotate that password everywhere else it was ever used, and delete old, unused accounts whenever you get the chance.
