---
author: Jan Brennenstuhl
canonical_url: https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/
description: How often breached credentials show up at login, how to check them without leaking the password, and which risk signals help.
id: jb-research-compromised-credentials
kind: guide
license:
  name: CC BY 4.0
  scope: Original text; credited third-party media retain their own rights.
  url: https://creativecommons.org/licenses/by/4.0/
markdown_url: https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/index.md
modified: '2026-10-13T00:00:00+02:00'
published: '2023-04-21T00:00:00+02:00'
review_basis: ''
review_status: not-reviewed
reviewed: ''
series: ''
status: published
title: How do you protect accounts from stolen credentials?
topics:
- passwords
- application-security
---

# How do you protect accounts from stolen credentials?

**Short answer:** Check usernames and passwords against breach data with a privacy-preserving protocol, and add risk signals such as known devices and locations to the login decision. Breached credentials show up in about 1.5% of logins on the web, and in one study 7-25% of exposed passwords matched the victim's Google account.


<a id="key-findings"></a>
## Key findings


<a id="f-cred-breached-logins-1-5pct"></a>
> **Finding f-cred-breached-logins-1-5pct:** Telemetry from nearly 670,000 users and 21 million logins showed that 1.5% of logins on the web involve breached credentials.
>
> Source: [Thomas et al., Protecting accounts from credential stuffing with password breach alerting (USENIX Security 2019)](https://www.usenix.org/system/files/sec19-thomas.pdf)
> Link: https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/#f-cred-breached-logins-1-5pct



<a id="f-cred-alert-26pct-new-password"></a>
> **Finding f-cred-alert-26pct-new-password:** 26% of breach warnings shown at login led users to switch to a new password at least as strong as the original.
>
> Source: [Thomas et al., Protecting accounts from credential stuffing with password breach alerting (USENIX Security 2019)](https://www.usenix.org/system/files/sec19-thomas.pdf)
> Link: https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/#f-cred-alert-26pct-new-password



<a id="f-cred-google-match-7-25pct"></a>
> **Finding f-cred-google-match-7-25pct:** Between 7% and 25% of passwords exposed through breaches, phishing kits and keyloggers matched the victim's Google account.
>
> Source: [Thomas et al., Data Breaches, Phishing, or Malware? (CCS 2017)](https://dl.acm.org/doi/pdf/10.1145/3133956.3134067)
> Link: https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/#f-cred-google-match-7-25pct



<a id="f-cred-hash-prefix-12x"></a>
> **Finding f-cred-hash-prefix-12x:** In some contexts, the hash prefixes that common breach-checking services receive make remote guessing attacks 12 times more effective.
>
> Source: [Li et al., Protocols for Checking Compromised Credentials (CCS 2019)](https://rist.tech.cornell.edu/papers/c3.pdf)
> Link: https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/#f-cred-hash-prefix-12x


<a id="evidence"></a>
## Evidence


**Compromised credential studies**

| Study | Year | Sample | Method | Finding |
| --- | --- | --- | --- | --- |
| [Protocols for Checking Compromised Credentials](https://rist.tech.cornell.edu/papers/c3.pdf) (Cornell Tech, Cloudflare) | 2019 | Existing C3 services (HaveIBeenPwned, Google Password Checkup) | Formal analysis, leakage simulation, protocol design | Hash-prefix leakage can make guessing 12 times more effective; 2 stronger protocols remain practical. |

| [Protecting accounts from credential stuffing with password breach alerting](https://www.usenix.org/system/files/sec19-thomas.pdf) (Google, Stanford) | 2019 | Over 4 billion breached credentials; nearly 670,000 users and 21 million logins | Protocol design, Chrome extension telemetry | 1.5% of logins involve breached credentials; 26% of warnings led to a new password. |

| [Data Breaches, Phishing, or Malware? Understanding the Risks of Stolen Credentials](https://dl.acm.org/doi/pdf/10.1145/3133956.3134067) (Google, UC Berkeley, ICSI) | 2017 | 1.9 billion breached credentials, 12.4 million phishing and 788,000 keylogger victims | Longitudinal measurement, March 2016 to March 2017 | 7-25% of exposed passwords matched the victim's Google account. |


<a id="what-to-do"></a>
## What to do

<a id="for-engineers"></a>
### For engineers

- Check credentials against breach data at sign-up, password change and login. Use a protocol that never sends the password or its full hash to the checking service. Thomas et al. combine "computationally expensive hashing, k-anonymity, and private set intersection"; Li et al. show how much a plain hash prefix can leak.
- Don't decide a login on the password alone. Thomas et al. (2017) show that risk signals such as a user's historical geolocations and device profiles reduce the hijacking risk from stolen passwords. The [reinforced authentication entry](https://www.janbrennenstuhl.eu/knowledge-base/account-security/reinforced-authentication/) collects studies on login risk scoring.
- Watch for stuffing and spraying patterns across accounts, not only per account. See [password spraying](https://www.janbrennenstuhl.eu/password-spraying/) and [honeytokens](https://www.janbrennenstuhl.eu/honeytoken/) for detection ideas.

<a id="for-product-and-ux"></a>
### For product and UX

- Tell users when their credentials appear in a breach, and make the next step a single action. In the Google study, 26% of warnings led to a new password that was at least as strong.
- Expect most users not to act on a warning alone. The [password reuse entry](https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/) covers what makes a notification work and where notifications fall short.

<a id="the-studies-in-detail"></a>
## The studies in detail

<a id="protocols-for-checking-compromised-credentials"></a>
### Protocols for Checking Compromised Credentials

"To prevent credential stuffing attacks, industry best practice now proactively checks if user credentials are present in known data breaches."

For this paper, researchers from Cornell Tech and Cloudflare analyzed existing compromised credential checking (C3) services such as HaveIBeenPwned and Google Password Checkup. They give the first formal description of C3 services, including operational requirements and threat models. Current services have the client share a short prefix of a password hash. The authors show that in some contexts this prefix makes remote guessing 12 times more effective. They then propose "two new protocols that provide stronger protection for users' passwords", implement them, and show that they remain practical to deploy.

[Read the paper (PDF)](https://rist.tech.cornell.edu/papers/c3.pdf)

<a id="protecting-accounts-from-credential-stuffing-with-password-breach-alerting"></a>
### Protecting accounts from credential stuffing with password breach alerting

Researchers from Google and Stanford describe how Google's password breach alerting works, which constraints and hard requirements it meets, and which cryptographic protocols it uses. Their cloud service covered over 4 billion breached credentials, and a Chrome extension served as the first client.

> "Our protocol relies on a combination of computationally expensive hashing, k-anonymity, and private set intersection. Our approach improves on existing protocols by taking into account both an adversarial client and server, while also minimizing the chance of false positives."

Anonymous telemetry from nearly 670,000 users and 21 million logins showed that 1.5% of logins on the web involved breached credentials. 26% of the warnings led users to migrate to a new password at least as strong as the original.

[Read the paper (PDF)](https://www.usenix.org/system/files/sec19-thomas.pdf)

<a id="data-breaches-phishing-or-malware-understanding-the-risks-of-stolen-credentials"></a>
### Data Breaches, Phishing, or Malware? Understanding the Risks of Stolen Credentials

Between March 2016 and March 2017, researchers from Google, UC Berkeley and the International Computer Science Institute identified 788,000 potential keylogger victims, 12.4 million potential phishing kit victims and 1.9 billion usernames and passwords exposed in data breaches. With this data, they "explore to what degree the stolen passwords […] enable an attacker to obtain a victim's valid email credentials — and thus complete control of their online identity due to transitive trust". In their case study of Google accounts, 7-25% of exposed passwords matched the victim's Google account.

The study is from 2017, but its mitigation still applies today: the authors show that adding risk signals, such as a user's historical geolocations and device profiles, to authentication helps mitigate hijacking with a correct but stolen password.

[Read the paper (PDF)](https://dl.acm.org/doi/pdf/10.1145/3133956.3134067)

<a id="related"></a>
## Related

- [How common is password reuse?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/)
- [Do login challenges and risk scoring stop account takeover?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/reinforced-authentication/)
- [Step-up authentication](https://www.janbrennenstuhl.eu/step-up-authentication/)


---

Cite as: Jan Brennenstuhl. "How do you protect accounts from stolen credentials?." Brennenstuhl on Security, 21 April 2023. https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/
License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) for the original text; credited third-party media keep their own rights.