CircleCI has several mechanisms in place to protect accounts against brute-force login attempts and credential stuffing attacks. This article explains what protections exist and what you can do to strengthen your account security.
Built-in authentication protections
CircleCI enforces rate limiting on login attempts. After a threshold of failed login attempts is reached, further attempts are temporarily blocked. This applies to email and password logins.
CircleCI also monitors for suspicious login activity and will notify users when an access attempt is detected from an unfamiliar location or IP address. If you receive such a notification and do not recognize the activity, follow the steps in the notification email to secure your account.
Strengthen your account protection
The most effective step you can take is enabling Multi-Factor Authentication (MFA). MFA means that even if your password is guessed or stolen, an attacker cannot access your account without also having access to your authenticator app.
MFA is mandatory for all standalone (email and password) CircleCI accounts as of December 2025. If you have not yet set it up, visit your user settings to do so.
Password best practices
Choosing a strong, unique password is one of the most important steps you can take to protect your account. Weak or reused passwords are a leading cause of account compromise — if one service you use is breached, attackers will try those same credentials on other services (known as credential stuffing).
Choose a strong password. Use a password that is long (at least 16 characters), and includes a mix of uppercase letters, lowercase letters, numbers, and symbols. Avoid dictionary words, names, or predictable patterns.
Never reuse passwords. Your CircleCI password must be unique — do not use the same password you use for any other service, including GitHub, email, or other CI/CD tools. If one of those services is ever compromised, a reused password puts your CircleCI account at risk too.
Use a password manager. A password manager makes it easy to generate and store strong, unique passwords for every service without having to memorize them.
Rotate your password regularly. Change your password at least every 90 days, or immediately if you suspect it may have been compromised. Regular rotation limits the window of exposure in the event your credentials are leaked from a third-party breach. See the steps below for how to do this depending on how you log in.
How to rotate your password — email and password accounts
If you log in to CircleCI with an email address and password:
Log in to CircleCI and click your avatar in the bottom-left corner, then select User Settings.
Navigate to the Security tab.
Under Change Password, enter your current password, then enter and confirm your new password. Your new password must be at least 16 characters and meet the strength requirements above.
Click Save. All existing sessions will be invalidated and you will be prompted to log in again with your new password.
Update your new password in your password manager so you don't lose access.
If you have forgotten your current password, use the Forgot password? link on the login page to reset it via email.
How to rotate your password — GitHub or Bitbucket OAuth accounts
If you log in to CircleCI via GitHub or Bitbucket OAuth, your password is managed entirely by that provider — there is no separate password to change within CircleCI. To rotate your password:
GitHub: Go to GitHub → Settings → Password and authentication and update your password there.
Bitbucket: Go to Bitbucket → Personal settings → Password and update your password there.
We also strongly recommend enabling MFA on your GitHub or Bitbucket account if you have not already done so, as this is the primary layer of protection for your CircleCI access.
Additional recommendations
Regularly review your active API tokens in user settings and remove any that are no longer needed.
Monitor your organization's audit log for unexpected login events or pipeline activity.
If you suspect an attack is in progress
If you notice repeated failed login attempts on your account or receive unexpected login notifications, contact us at [email protected] with details including your account email and a description of the activity.
Additional resources
Does CircleCI Support Multi Factor Authentication?
What happens to my active sessions when I reset my password?
How do I report a security vulnerability?