Skip to content
ENExplore Calculators

Account Lockout Threshold Calculator

Trade a lockout threshold against helpdesk cost and how much of a common-password list an attacker can still test.

About Account Lockout Threshold Calculator

A lockout policy hands an attacker a fixed guessing budget: threshold attempts every lockout period, forever. Ten attempts per 15 minutes is 350,400 guesses per account per year, enough to walk a 10,000-entry common-password list 35 times over. Legitimate lockouts run the other way, modelled as a geometric burst — each additional failure in an episode is less likely, so raising the threshold cuts lockouts exponentially. This is the clearest example of a security control with two opposed costs, and the arithmetic shows that lockout duration, not threshold, is the lever that actually starves an online attacker.

Formulas

Account Lockout Threshold

guesses per account per year = threshold × (60 ÷ lockout minutes) × 24 × 365, and list coverage = that ÷ password list size.

threshold
Failures allowed before the account locks
lockout minutes
How long the account stays locked before attempts resume

Legitimate lockout volume

legitimate lockouts = users × episodes per year × continuation rate^(threshold − 1).

Worked example

With the default values below, Account Lockout Threshold Calculator returns Guesses Allowed per Account per Year of 350,400. Change any input above and every figure here is recalculated in your browser.

Inputs used

Failed attempts before lockoutaccepts 1–100 attempts
10 attempts
Lockout durationaccepts 1–10,080 minutes
15 minutes
Users in scopeaccepts 1–10,000,000 users
10,000 users
Failed-login episodes per user per yearaccepts 0–500 episodes
6 episodes
Chance an episode produces another failureaccepts 1–99 %
55 %
Cost per assisted unlockaccepts 0–1,000 $
22 $
Unlocks handled by self-serviceaccepts 0–100 %
70 %
Size of the attacker's password listaccepts 1–1,000,000,000 passwords
10,000 passwords

Results

Guesses Allowed per Account per Year
350,400 guesses
Share of the Password List Testable
100.0%
Legitimate Lockouts per Year
276 lockouts
Annual Unlock Cost
$1,824
Recommendation
Too permissive — the yearly guessing budget covers the whole list, so lower the threshold or lengthen the lockout

Step by step

  1. 1Values used
  2. 2Account Lockout Threshold
  3. 3Legitimate lockout volume
  4. 4Guesses Allowed per Account per Year= 350,400 guesses
  5. 5Share of the Password List Testable= 100.0
  6. 6Legitimate Lockouts per Year= 276 lockouts
  7. 7Annual Unlock Cost= 1,824
  8. 8Recommendation= Too permissive — the yearly guessing budget covers the whole list, so lower the threshold or lengthen the lockout

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation or tax into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Account Lockout Threshold calculated?

guesses per account per year = threshold × (60 ÷ lockout minutes) × 24 × 365, and list coverage = that ÷ password list size. A lockout policy hands an attacker a fixed guessing budget: threshold attempts every lockout period, forever. Ten attempts per 15 minutes is 350,400 guesses per account per year, enough to walk a 10,000-entry common-password list 35 times over. Legitimate lockouts run the other way, modelled as a geometric burst — each additional failure in an episode is less likely, so raising the threshold cuts lockouts exponentially.

Why does Account Lockout Threshold matter?

This is the clearest example of a security control with two opposed costs, and the arithmetic shows that lockout duration, not threshold, is the lever that actually starves an online attacker.

What values do I need to enter?

This calculator takes 8 inputs: Failed attempts before lockout, Lockout duration, Users in scope, Failed-login episodes per user per year, Chance an episode produces another failure, Cost per assisted unlock, Unlocks handled by self-service, Size of the attacker's password list. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

What threshold does current guidance suggest?

NIST SP 800-63B asks for no more than 100 consecutive failed attempts and prefers rate limiting with increasing delays over hard lockouts, because a hard lockout is itself a denial-of-service vector against known usernames.

Why does a longer lockout beat a lower threshold?

Because the yearly budget is threshold ÷ lockout duration. Halving the threshold from 10 to 5 halves the budget; extending the lockout from 15 to 60 minutes quarters it, and it inconveniences far fewer legitimate users because most episodes never reach the threshold at all.

Related Calculators

Account Lockout Threshold Calculator | Calcrivo