Credential stuffing, password spraying and passkeys explained
Understand how stolen credentials and password guesses are used against accounts, and how layered authentication controls can reduce risk.
A password is a secret used to authenticate an account. When people reuse the same password across services, exposure at one service can put other accounts at risk. Attackers can also guess common passwords without possessing a leaked credential pair. These attacks have different patterns, so defenses should address both the account and the wider authentication system.
## Credential stuffing and password spraying
Credential stuffing is the automated use of previously obtained username and password pairs to attempt sign-ins elsewhere. It succeeds when a pair is still valid, including when a password was reused. Password spraying instead tries one or a small number of likely passwords across many accounts. Password guessing can also target many candidate passwords against one account. These patterns can overlap, and failed attempts alone do not prove an account was compromised. [OWASP describes the distinctions](https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html).
Use a unique, strong password for each service; a password manager can generate and store different passwords. If credentials may have been exposed, change the affected password and any reused copies, review account activity, and follow the provider’s recovery instructions. Never send passwords to an unverified support contact.
## What is a passkey?
A passkey is a cryptographic credential used to sign in to a service. The authenticator keeps a private key and proves possession without sending a reusable password to the service. The user may unlock the authenticator using a device PIN or biometric, depending on its configuration. Some passkeys can be synchronized across devices; others are bound to one device. [NIST SP 800-63B-4 guidance on syncable authenticators](https://pages.nist.gov/800-63-4/sp800-63b.html#syncable-authenticators) describes security and recovery considerations.
Correctly implemented passkeys can resist phishing because authentication is bound to the intended service. They are not a guarantee against every account compromise: malicious software, stolen sessions, insecure account recovery, or a compromised synchronization account can still matter. Maintain supported recovery methods and protect the account used to synchronize credentials.
## Layer defenses for account owners and service operators
Multi-factor authentication (MFA) requires distinct authentication factor types. Prefer phishing-resistant options where available, and protect fallback and recovery procedures too. A passkey can use a local unlock factor, but whether a particular deployment satisfies an assurance policy depends on its configuration and requirements. See [Mithril’s phishing guide](https://blog.mithril.fund/what-is-phishing-spear-phishing?lang=en) for more on phishing and MFA.
Service operators can combine breached-password screening, rate limits, monitoring and appropriately designed recovery. Apply limits across accounts and traffic sources, test for false positives and provide a safe route for legitimate users who are locked out. Reauthentication before sensitive actions and session revocation after suspected compromise can help reduce harm. [OWASP guidance](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html) covers authentication controls and tradeoffs.
No single control proves an account is secure. Review alerts and recovery events, investigate suspicious activity and adjust protections to the service’s risks. Sources reviewed on 2026-10-29.