SSOGEN / Learn / Credential Stuffing: How It Works, How It Differs From Password Spraying, and What Stops It
Learn
Credential Stuffing: How It Works, How It Differs From Password Spraying, and What Stops It
Credential stuffing replays username and password pairs leaked from one service against another's login, and it works whenever people reuse a password.
Updated
Credential stuffing is an automated attack: attackers try username and password pairs leaked from one service on another service’s login page. It works because people reuse passwords: a pair stolen from a forgotten shopping site opens a work account if the password is the same.
MITRE ATT&CK lists it as T1110.004 (page last modified May 12, 2026, read 2026-10-09).
Password spraying is the related attack. The attacker has no leaked pairs, only a list of account names and a few common passwords. The same three controls stop both:
- a second step;
- limits on attempts;
- a block on known-bad passwords.
What is credential stuffing, exactly?
OWASP’s definition: bots feed stolen username and password pairs into login forms to take over accounts, and password reuse is what makes it work (OWASP, Credential Stuffing, read 2026-10-08).
- Source of the pairs. Breach dumps, phishing and password-dump sites.
- Targets. MITRE adds SSH, RDP, FTP, SMB, LDAP and cloud apps with federated sign-in, beyond websites.
- No guessing. Each pair gets one attempt, so the sign-in log shows many accounts, each tried once or twice.
- Real passwords. The volume is automated, but the pairs are real, often with the correct password.
How is password spraying different?
MITRE’s page on password spraying, T1110.003 (version 1.8, last modified October 24, 2025, read 2026-10-08), describes one password, or a short list of common ones, tried against many accounts. This keeps the attacker under per-account lockout limits.
The NCSC’s password administration guidance (read 2026-10-08) describes the same pattern: a few commonly used passwords against a large number of accounts.
Credential stuffing and password spraying side by side
Credential stuffing
Starts from leaked pairs
- Has: leaked username and password pairs
- Tries: each pair once, on a different service from the one it leaked from
- Works because: the person reused the password
- Logs show: many accounts, each with one or two failures; some succeed on the first try
Password spraying
Starts from account names
- Has: a list of account names, and a short list of common passwords
- Tries: one password across every account, then the next password
- Works because: some people in any large group pick a common one
- Logs show: one source or a few, many accounts, the same password, steady pace
| Credential stuffing | Password spraying | |
|---|---|---|
| What the attacker has | Leaked username and password pairs | A list of account names, and a short list of common passwords |
| What they try | Each pair once, on a different service from the one it leaked from | One password across every account, then the next password |
| Why it works | The person reused the password | Some people in any large group pick a common one |
| In the logs | Many accounts, each with one or two failures; some succeed on the first try | One source or a few, many accounts, the same password, steady pace |
| Lockout effect | Few accounts reach the limit; stuffing can still cause failures and lockouts, per MITRE | Built to stay under the per-account limit |
| Best defenses | Second step, breached-password check, per-source limits, resets for exposed accounts | Second step, common-password blocklist, throttling, alerts on one password across many accounts |
A single event does not distinguish them. Count failures per account and per source over an hour, and the pattern becomes clear.
What do the log patterns look like?
Acme Corp (acme.example) has 400 employees and a sign-in page. The examples below show each attack in a simplified log, with addresses from the documentation range.
Stuffing against the sign-in page. Over twenty minutes, one address sends 600 attempts.
| Time | Source | Account | Result |
|---|---|---|---|
| 02:10:01 | 192.0.2.77 | maria.lopez | failure |
| 02:10:02 | 192.0.2.77 | ken.adeyemi | failure |
| 02:10:02 | 192.0.2.78 | tom.reyes | success |
| 02:10:03 | 192.0.2.79 | li.wang | failure |
| 02:10:04 | 192.0.2.77 | jane.smith | failure |
Every account name is different, and each appears about once. Real attackers spread the attempts over many addresses, so per-address counts look small. Watch two signals:
- the ratio of failures to distinct accounts;
- a lone success among many failures.
Spraying against Active Directory. The attacker tries Spring2026! on every account, waits, then tries the next password. Our page on event ID 4625 shows what to read in Windows.
On the server that was hit, a failed logon is event 4625:
- Status 0xC000006D with Sub Status 0xC000006A means the user name was correct and the password wrong.
- 0xC0000064 means the name does not exist.
Many 0xC0000064 events in a row can mean someone is enumerating names. Many 0xC000006A events for one account, from an address that is not the user’s, indicate password guessing.
For Kerberos, a wrong password appears as event 4771 on the domain controller, failure code 0x18, not as 4768.
The event pages place 4625 on the computer where the attempt was made and 4771 on domain controllers only, so search both.
| Event | Where | What a spray looks like |
|---|---|---|
| 4625, Sub Status 0xC0000064 | Server reached | Many different names from one source: the attacker is checking which accounts exist |
| 4625, Sub Status 0xC000006A | Server reached | Names that exist, wrong password, same source, close together |
| 4771, failure code 0x18 | Domain controller | The same pattern at the Kerberos step; many in a short time can point to guessing |
For a mixed set of events, paste them into the Event ID 4625 decoder. It runs in your browser and uploads nothing.
How do you defend against credential stuffing and password spraying?
A second step
OWASP’s prevention cheat sheet (read 2026-10-09) calls multi-factor authentication “by far the best defense against the majority of password-related attacks”.
- NCSC. A second factor is one of the most effective ways to protect a password-protected account.
- MITRE. It lists a second step as a mitigation for both techniques.
A typed code can still be phished, and an approval prompt can still be spammed (read MFA fatigue attacks). Phishing-resistant MFA and passkeys remove the shared secret an attacker would replay.
Checks on new passwords
NIST SP 800-63B-4 (the current revision; page dated 26 Aug 2025, read 2026-10-09), section 3.1.1.2, says services must check a new password against a blocklist of commonly used, expected or compromised values, including passwords from earlier breaches.
- Against stuffing. A breached-password check prevents users from choosing the pairs that stuffing relies on.
- Against spraying. The NCSC makes the same point about deny lists for the common passwords that spraying uses.
The NIST password guidelines cover the other rules.
Limits on attempts
Per-account lockout alone does not stop spraying, and attackers can abuse it to lock users out.
- Throttling. The NCSC prefers a delay that grows between attempts.
- Upper bound. NIST section 3.2.2 sets 100 consecutive failures against one account’s authenticator.
- Per source. Add limits per source address, and watch for slow attacks spread over many addresses; OWASP’s cheat sheet says limits must account for such low-volume attacks.
Sign-up pages need the same limits, plus a few more; CAPTCHA alternatives covers them.
Watch for the shape of the attack
Alert on three patterns:
- Distinct accounts failing from one source.
- One password failing across many accounts.
- A success right after many failures.
MITRE’s detection notes describe the first two: many failures from distinct pairs at one address, and one password failing across many accounts.
Reset exposed accounts
If a breach list contains an address at your domain, reset that account. MITRE’s mitigation is proactive account management: reset accounts known to appear in breach databases.
What should you tell your users?
Send this notice before an incident, not after one.
Subject: Use a different password for work
Attackers collect passwords leaked from other websites and try them on company sign-in pages. If your work password matches one you use elsewhere, they can sign in as you.
Set a password you use nowhere else and turn on your second sign-in step. If you get a sign-in prompt you did not start, deny it and tell us at help@acme.example. We never ask for a code by phone.
What does SSOGEN do about it?
SSOGEN limits attempts per client, where a client is one network address, and you set each limit on the security settings page. The defaults:
- local password sign-in: 20 attempts per minute;
- second-step codes: 5 per minute per person and client;
- passkey sign-in: 20 per minute.
Each range runs from 1 to 10,000. After 10 failed codes in a row, across every method, a person’s second step locks for 15 minutes, and the lock ends on its own.
SSOGEN offers these second steps (multi-factor authentication guide):
- Authenticator app. A code from an app.
- Passkey. A passkey as the second step.
- Email or text. Emailed or texted codes.
- Recovery codes. Recovery codes as a second step.
The audit log records sign-ins and refusals: when, from where, who and what, with a result of success, failure or denied. This is the data behind the log patterns above.
- Filter. By result, area, time and source address.
- Export. Up to 1,000 matching events as CSV or JSON from the search.
Questions people ask
Is credential stuffing the same as brute force?
No. Brute force guesses passwords; stuffing submits real pairs from another breach. MITRE files both under the brute force family (T1110).
Does a lockout policy stop credential stuffing?
Only partly. MITRE lists lockout thresholds as a mitigation, but each account sees one or two attempts, so few reach the limit. Stuffing can still cause failures and lockouts.
How do you avoid credential stuffing?
As a user, use a password nowhere else and turn on a second step. If you run the sign-in page, add MFA, block breached passwords, and limit attempts per account and per source, as OWASP and NIST describe.
What is a credential attack?
An attempt to obtain or use someone’s login details to reach an account. In MITRE ATT&CK, guessing, cracking, spraying and stuffing are the four sub-techniques of brute force (T1110).
Which is easier to spot, stuffing or spraying?
Spraying. It leaves one password across many accounts, a pattern you can search for. Stuffing with rotating addresses is harder to detect; look at the failure-to-success ratio.
Does MFA stop password spraying?
It stops a password alone from working, according to the NCSC. It does not stop a user who approves a prompt they should have denied.
Where to go next
Read phishing-resistant MFA, MFA fatigue attacks, the NIST password guidelines, passkeys compared with passwords, or return to the Learn hub.
Lockouts appear as event 4740. The failed attempts appear as 4771 or 4776, which helps you tell stuffing from a stale password.
Unique passwords from a password manager, or no application password at all through SSO, both defeat reuse. See password manager vs SSO. With a second step, a replayed password is not enough; why MFA is important shows the measured effect.
Sources, all read 2026-10-08 and re-checked 2026-10-09: MITRE ATT&CK T1110.003 and T1110.004, OWASP, the NCSC and NIST pages linked above.