Size a credential stuffing campaign: how many stolen pairs authenticate, how many MFA stops, and the loss that remains.
Credential stuffing is a volume business: the per-pair success rate is tiny, but bots replay millions of pairs, so a 0.5 % rate on a million-pair list is 5000 valid logins. MFA is the only control in the chain that acts after a correct password, so takeovers scale with the share of accounts that still lack it. Stuffing is the most common cause of account takeover on consumer platforms, and the arithmetic shows the residual risk is set almost entirely by your MFA enrolment gap rather than by password policy.
Credential Stuffing Risk
successful logins = pairs replayed × success rate; takeovers = successful logins × (1 − MFA coverage × MFA block rate).
successful logins = pairs replayed × success rate; takeovers = successful logins × (1 − MFA coverage × MFA block rate). Credential stuffing is a volume business: the per-pair success rate is tiny, but bots replay millions of pairs, so a 0.5 % rate on a million-pair list is 5000 valid logins. MFA is the only control in the chain that acts after a correct password, so takeovers scale with the share of accounts that still lack it.
Stuffing is the most common cause of account takeover on consumer platforms, and the arithmetic shows the residual risk is set almost entirely by your MFA enrolment gap rather than by password policy.
This calculator takes 5 inputs: Credential pairs replayed, Pairs that authenticate, Accounts with MFA enabled, Takeovers MFA blocks when present, Cost per taken-over account. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because the input is free and effectively unlimited. At 0.5 % an attacker needs 200 attempts per hit, which is seconds of bot time. The defence has to break the economics — rate limiting per source, bot detection, and MFA — not hope for a lower hit rate.
Blocking passwords that appear in breach corpora at registration and reset, since a pair can only be replayed if the password is reused. Device fingerprinting and IP reputation cut the volume, and passkeys remove the replayable secret entirely.