Account Lockout Policy Calculator

Work out account lockout policy instantly with clear inputs, formula shown and shareable results.

About Account Lockout Policy Calculator

Lockout converts an online guessing attack into a rate-limited one: five attempts per fifteen minutes allows only twenty guesses an hour, which makes even a weak password computationally safe against remote attack. The cost is a denial-of-service vector, since anyone who knows a username can lock the account, which is why progressive delays are often preferred to hard lockouts.

Formula

Lockout rate limiting

guesses per hour = attempts x 60 / lockout minutes; keyspace = 2^entropy; time to exhaust = keyspace / annual guess rate

Worked example

With the default values below, Account Lockout Policy Calculator returns Guesses an attacker can make per hour of 20.0. Change any input above and every figure here is recalculated in your browser.

Inputs used

Failed attempts before lockoutaccepts 1–100: 5
Lockout durationminimum 0.1 min: 15 min
Password entropyaccepts 10–128 bits: 40 bits
Users in scopeminimum 1: 2,000

Results

Guesses an attacker can make per hour: 20.0
Time to exhaust the keyspace at that rate: 6,271,455.7824
Share of a lockout an attacker triggers per wrong guess: 20.0%
Policy assessment: Balanced against both brute force and denial of service

Step by step

1Values used
2Lockout rate limiting
3Guesses an attacker can make per hour= 20.0
4Time to exhaust the keyspace at that rate= 6,271,455.7824
5Share of a lockout an attacker triggers per wrong guess= 20.0
6Policy assessment= Balanced against both brute force and denial of service

Assumptions and limits

The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Is lockout or rate limiting better?

Progressive delay — increasing the wait after each failure — resists brute force without giving an attacker a denial-of-service tool. Hard lockout is simpler but weaponisable.

Should administrative accounts be lockable?

Locking out the last administrator is a real risk. Use certificate or key-based authentication for those accounts so password lockout does not apply.