IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Credential stuffing, password spraying and bots
One morning, thousands of sign-in tries hit the shop's login page in an hour. Almost all fail. A program is typing them, not a person. Your goal: tell stuffing from spraying, and name the defenses that stop them.
- Stuffing tries a different leaked password on each account.
- Spraying tries the same common password on many accounts.
- Both make about one try per account, so a lockout does not see them.
- Layers win: MFA, passkeys, device checks and cross-account alerts.
Two ways to knock
Credential stuffing
The attacker has a list of email and password pairs from another company's breach dump. They try each pair on your site. Many people use one password on many sites. This is password reuse. So Maya's leaked password may also open her account here. Few pairs work, but a long list still wins many accounts. This is credential stuffing.
Password spraying
The attacker has a list of usernames but no passwords. They try one very common password once on every account. Somebody usually chose a weak password. This is password spraying. It is the reverse of brute force, which tries many passwords on one account.
a thief with keys from a lost bag, who tries every key on every door in your building. That is stuffing. Spraying is a thief who tries the PIN 1234 on every locker in a gym. Nobody watches one locker for long.
Why the usual defenses miss
A strong password does not save Maya from stuffing. Say her 20-character password was also used on a forum that got hacked. The attacker now has the right password, and X.
Lockout misses both attacks. An account lockout blocks an account after too many wrong tries on it. But both attacks make one or two tries per account. No account reaches the limit.
A hard lockout can help the attacker. They can fail on purpose to lock real people out. Slowing attackers down is better. This is throttling. See Password policy that works.
Six defenses that work together
No single control wins. Put layers in front of the attacker; each catches what the others miss.
- MFA and passkeys. With MFA, the right password is not enough. A passkey removes the password, so there is nothing to stuff or spray. MFA helps only accounts that use it. A phishing proxy can still pass on a code (see adversary-in-the-middle).
- Breached-password check. Compare new passwords with a blocklist of leaked ones. A leak not on your list yet still slips through (see Breached-password detection).
- Limits by address, account and device. A rate limit on one account is not enough. A botnet uses many addresses. So count by address and device too, as one signal (see Rate limits, quotas & abuse control).
- Bot detection without puzzles. Bot detection quietly checks speed, network and the browser's traits (its device fingerprint). Show a CAPTCHA puzzle only to doubtful visitors (see Bot detection & CAPTCHA).
- Cross-account detection. Watch all accounts together. One password on many accounts is the spraying sign. One try per account, each with a new password, from the same few browsers, is the stuffing sign (see Detection engineering).
- Tell the user. Send "Was this you?" after a sign-in from a new device.
Zara sees failed sign-ins climb, but no account has two failures. Her dashboard groups them across accounts: one password on 40 accounts from one network. That is a spray, and she blocks the network. Next week, 300 addresses try a different password on each account. Her bot check sees the same browser traits every time, and MFA stops the few that got through.
🧪 Interactive lab — enable JavaScript to play with this one.
Go deeper: Why the front door gets knocked first
Attackers try the plain login form first. Anyone can reach it. They do not knock by hand. A bot is a program that does a job on its own, such as typing logins. A botnet is a large group of hacked computers that run bots together. Each computer has its own IP address, so the tries seem to come from many places.
Go deeper: More on three defenses
NIST SP 800-63B-4 allows at most 100 failed tries in a row on one account. It also says to compare new passwords with a blocklist of breached, common and context-specific words. The user must then choose another one. Some systems also check at sign-in.
One address that tries 300 accounts is odd. But a botnet spreads its tries, so use address limits as one signal, never as the only wall. Puzzles annoy people, and some tools can solve them.
A same-password alert catches spraying. The browser-trait signal catches stuffing. After an alert, slow the source and ask for a stronger proof. Also tell the user when the right password was used but the second step failed.
Go deeper: Reading the log: three patterns
Every sign-in try leaves a line in the login log. Look at the lines together, not one by one. These three patterns look different.
| Pattern | Accounts | Passwords | Where from |
|---|---|---|---|
| Normal | A few people, each one a few times | Each person's own, with a typo now and then | Each person's usual device |
| Spraying | Very many accounts, one try each | The same common password on all | Often one network, and slow |
| Stuffing | Very many accounts, one try each | A different password each, from a leak | Many addresses, and the same browser traits again and again |
Go deeper: spotting "the same password" and the ATT&CK IDs
How can a system see "the same password" without storing passwords? One common design keeps a keyed hash of each wrong password for a short time. It counts repeats. It never writes the password itself to a log. A cheaper signal needs no password at all: many accounts fail from one network in a short time.
Give every failure the same message and the same timing. Suppose the page says "no such user" for unknown names and "wrong password" for real ones. Then attackers can tell them apart. OWASP's Authentication Cheat Sheet gives this advice.
The MITRE ATT&CK catalog names both attacks. Both sit under T1110 Brute Force. The IDs were checked against the catalog in October 2026.
| Attack | ATT&CK technique |
|---|---|
| Credential stuffing | T1110.004 Brute Force: Credential Stuffing |
| Password spraying | T1110.003 Brute Force: Password Spraying |
MITRE lists MFA, password policies and account use policies as mitigations for both.
Hardening a login against credential stuffing? Talk to our team.