Accounts
Credential stuffing
In Turkish: Kimlik bilgisi doldurma (credential stuffing)
Attackers take email and password pairs leaked from one site and automatically try them on many others.
When a site is breached, its list of logins can end up in circulation. Programs then try those same pairs on banks, shops and email services by the thousand. Anyone who used the same password in two places is exposed.
The defence is simple: a different password for each account, plus a second step. Then one leak stays one leak.
What to do
- Check whether your email appears in known leaks and change those passwords.
- Never reuse a password, especially for email.
- Turn on a second step on important accounts.
Related terms
Learn it in the Academy
Try it
Free tools that put this to use.
- Password check
Has this password appeared in a data breach? Checked without the password ever leaving your device.