EcommerceFraud

Stuffing Prevention

Blunt credential-stuffing attacks by blocking previously leaked login credentials.

Start with 500 free creditsDocumentation

Password breaches · 1 credit per lookup · no monthly fee

Login attempts

Attack blocked

Leaked credentials rejected: 4,182

The problem

Credential stuffing is automated reuse: attackers replay millions of leaked email/password pairs against your login. Every user who reused a breached password is a door that's already unlocked.

With Encrata

Screen passwords at login, not just at creation. When a user authenticates with a password that appears in breach data, step up, require MFA, prompt a change, or flag the session. You're closing exactly the doors the stuffing lists have keys to.

How it works

1

Hash locally

Your client hashes the password and sends only the first characters of the hash, the password itself never leaves the device.

2

We match anonymously

Encrata checks the prefix against the breach corpus via k-anonymity and returns whether the password was found and how many times.

3

Reject or accept

Block passwords that appear in breach dumps at registration, reset or login. One credit per check.

One call, structured answer

Stuffing Prevention runs on the password breaches lookup at 1 credit per lookup. Same API key, same JSON shape as every other Encrata lookup.

  • k-anonymity: the password never leaves the user's device
  • Blocks the exact credentials attackers use in stuffing lists
  • 1 credit per check, screen every registration and reset
  • A single API call satisfies auditors asking for compromised-password controls
Terminal
curl -X POST "https://encrata.com/api/agent/password-breaches" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sha1": "5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8"}'
response.json
{
  "prefix": "5BAA6",
  "found": true,
  "count": 52372427,
  "credits": 1
}

Screen at login too

Screen at login, not just creation: when a correct password is also a breached password, step up, MFA challenge, change prompt, or session flag depending on your risk posture. Combine with velocity signals: breached credentials plus a spike in attempts from new IPs is a stuffing run in progress, and the combination justifies aggressive throttling.

Doors the lists cannot open

Stuffing succeeds because reused breached credentials work by default; login-time screening makes them stop working precisely where attackers try them. The blocked-attempt counter becomes your evidence: teams typically discover thousands of stuffing attempts per week that were previously indistinguishable from failed typos.

More password breaches use cases

View all

Choose password

••••••••••
Found in 3 breaches — choose another

Password Screening

Reject passwords already circulating in breach dumps at the moment of registration

SaaSAuthentication

Reset password

••••••••
••••••••••••

Reset Screening

Stop users from choosing a compromised password when they reset the old one

BankingSecurity

Password compromised

Seen in a public breach dump

Change password

User Alerts

Warn users still relying on passwords that have already appeared in known breaches

CybersecurityNotification
Start with 500 free credits
$curl https://encrata.com/api/agent/lookup -H "Authorization: Bearer YOUR_API_KEY" -d '{"e": "satya@microsoft.com"}'