Brute force tries many passwords against one account. Credential stuffing replays username and password pairs leaked from other sites. Password spraying tries one weak password across many accounts. Defenses overlap, and MFA is the strongest single control against all three.
How they differ
- Brute force: the attacker has a dictionary and one target. Your logs show many failures on one account.
- Credential stuffing: the attacker has leaked pairs from another breach. Your logs show many accounts, each tried once or twice, often with valid-looking emails.
- Password spraying: the attacker has a short list of common passwords. Your logs show one password across many accounts.
OWASP notes that the defenses for these attacks overlap and also help against brute force.
Defenses that work on all three
MFA. OWASP's credential stuffing guidance calls it by far the best defense against most password-related attacks. Where you cannot require it for everyone, require it at least for administrators. Step-up checks for new devices or risky actions are a middle path.
Breached password checks. Screen new passwords against known breached lists, for example through a Pwned Passwords style service, which can be called by API or self-hosted.
Per-account throttling. OWASP says to cap failed attempts per account, not per IP address, since attackers rotate addresses. Let locked users recover through the forgotten-password flow, so lockout cannot be used to deny service.
Generic errors. Use one response for wrong password, unknown account and locked account, with consistent timing and status codes, so attackers cannot test which emails exist.
Defenses that help less than you think
- Blocking IPs. Attackers spread requests across proxy networks. Use graduated, temporary responses.
- CAPTCHA. Useful on suspicious logins, but OWASP cautions it is not perfect and tools exist that solve it at high rates.
- Device fingerprinting. Signals can be spoofed, and users have many devices, so layer it with other controls.
What to monitor
- Failed logins per account, and per source over long and short windows.
- A single password attempted across many accounts.
- Successful logins right after a burst of failures.
- New device sign-ins followed by sensitive changes.
Tell users about unusual events. See push fatigue for what happens when a stuffed password meets a push prompt.
A useful habit is to run a monthly review of your login metrics. Plot failures per account, failures per source and the ratio of failures to successes. Credential stuffing often shows up as an unusually low success rate spread across many accounts, which per-account lockouts alone will not reveal. Having a baseline makes the anomalies easy to see, and it helps you tune thresholds without locking out real users.
Quick check
Why does reuse matter?
Credential stuffing only works on people who reused a password that was exposed elsewhere.
Should lockout be per IP?
OWASP advises per account, since IPs are easy to rotate.
Sources
Last reviewed: 19 October 2026.
