Work out account lockout policy instantly with clear inputs, formula shown and shareable results.
Lockout converts an online guessing attack into a rate-limited one: five attempts per fifteen minutes allows only twenty guesses an hour, which makes even a weak password computationally safe against remote attack. The cost is a denial-of-service vector, since anyone who knows a username can lock the account, which is why progressive delays are often preferred to hard lockouts.
Lockout rate limiting
guesses per hour = attempts x 60 / lockout minutes; keyspace = 2^entropy; time to exhaust = keyspace / annual guess rate
Progressive delay — increasing the wait after each failure — resists brute force without giving an attacker a denial-of-service tool. Hard lockout is simpler but weaponisable.
Locking out the last administrator is a real risk. Use certificate or key-based authentication for those accounts so password lockout does not apply.