thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Security Fundamentals & Crypto

Credential Stuffing vs Password Spraying: What's the Difference?

Credential stuffing replays real username and password pairs leaked from other breaches, exploiting password reuse. Password spraying guesses common passwords across many usernames without knowing the actual passwords.

Credential Stuffing

Full definition
vs

Password Spraying

Full definition
Credential StuffingPassword Spraying
Input dataLeaked credential pairs from other breachesList of usernames plus common passwords
ExploitsPassword reuse across sitesWeak, common passwords
Attempts per accountTypically one pair per accountA few guesses per account
Success indicatorHigh success rate per known pairLow rate but broad reach
DefenseMFA, breached-password checks, bot detectionMFA, banned password lists, smart lockout
Remember it

Stuffing reuses stolen keys; spraying guesses common ones.

Exam tip

Key clue: if the scenario mentions a third-party breach or leaked credentials, the answer is credential stuffing. MFA defeats both.

Tested on

More Security Fundamentals & Crypto look-alikes