Account Lockout Threshold Calculator

guesses per account per year = threshold × (60 ÷ lockout minutes) × 24 × 365, and list coverage = that ÷ password list size. A lockout policy hands an attacker a fixed guessing budget: threshold attempts every lockout period, forever. Ten attempts per 15 minutes is 350,400 guesses per account per year, enough to walk a 10,000-entry common-password list 35 times over. Legitimate lockouts run the other way, modelled as a geometric burst — each additional failure in an episode is less likely, so raising the threshold cuts lockouts exponentially.

This is the clearest example of a security control with two opposed costs, and the arithmetic shows that lockout duration, not threshold, is the lever that actually starves an online attacker.

This calculator takes 8 inputs: Failed attempts before lockout, Lockout duration, Users in scope, Failed-login episodes per user per year, Chance an episode produces another failure, Cost per assisted unlock, Unlocks handled by self-service, Size of the attacker's password list. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

NIST SP 800-63B asks for no more than 100 consecutive failed attempts and prefers rate limiting with increasing delays over hard lockouts, because a hard lockout is itself a denial-of-service vector against known usernames.

Because the yearly budget is threshold ÷ lockout duration. Halving the threshold from 10 to 5 halves the budget; extending the lockout from 15 to 60 minutes quarters it, and it inconveniences far fewer legitimate users because most episodes never reach the threshold at all.