Credential stuffing and brute force

In short: Brute force tries many passwords; credential stuffing tries leaked combinations of name and password at other services.

In more detail: Because many people reuse passwords, stolen credentials from one service often work at others. Attackers test them automatically with millions of requests.

In Depth

• Protection for users: unique, long passwords (password manager), 2FA.
• Protection for operators: limit attempts per account and IP, gradual delay, CAPTCHA or Turnstile, alerts for unusual patterns.
• Do not reveal: Error messages should not say whether the username or the password was wrong.
• Checking: “Have I Been Pwned” shows whether an email address appears in leaks.
• Lock with care: A hard account lock can be abused to lock users out.

See also: Storing passwords safely (hashing with salt), Rate Limiting