Skip to content
ENExplore Calculators

Kerberos Ticket Lifetime Calculator

Work out TGT renewals per session, the 7-day renewal ceiling and KDC request load from your Kerberos policy.

About Kerberos Ticket Lifetime Calculator

A ticket-granting ticket is valid for its lifetime and can be renewed repeatedly until the renewal window expires. Renewals are cheap TGS exchanges; crossing the renewal ceiling forces a full AS exchange, which needs the user's credential rather than just the existing ticket. The 10-hour default exists so a stolen ticket expires within a working day, and lengthening it to avoid mid-shift prompts extends exactly that theft window — while a machine more than five minutes out of sync fails Kerberos entirely.

Formulas

Kerberos Ticket Lifetime

renewals per session = ceil(session length ÷ ticket lifetime) − 1, capped by the renewal window; beyond that window the client must authenticate again from scratch.

ticket lifetime
How long a TGT is valid before it must be renewed — 10 hours by default
renewal window
How long renewals may continue before a fresh AS exchange is required — 7 days by default

Clock skew tolerance

clock skew window = 2 × maximum tolerated skew, because a ticket can be either ahead of or behind the KDC clock.

5 minutes
Default maximum skew in both Windows and MIT Kerberos

Worked example

With the default values below, Kerberos Ticket Lifetime Calculator returns Renewals per Session of 1. Change any input above and every figure here is recalculated in your browser.

Inputs used

Ticket-granting ticket lifetimeaccepts 0.25–168 hours
10 hours
Renewal windowaccepts 0–30 days
7 days
Typical user session lengthaccepts 0.25–168 hours
12 hours
Users authenticating per dayaccepts 1–5,000,000 users
5,000 users
Maximum tolerated clock skewaccepts 0–60 minutes
5 minutes

Results

Renewals per Session
1
Ticket Lifetime
10h
Renewal Ceiling
168 hours
AS Requests to the KDC per Day
15,000
Total Clock Skew Window
10 minutes
Full Re-Authentication Required
No

Step by step

  1. 1Values used
  2. 2Kerberos Ticket Lifetime
  3. 3Clock skew tolerance
  4. 4Renewals per Session= 1
  5. 5Ticket Lifetime= 600
  6. 6Renewal Ceiling= 168 hours
  7. 7AS Requests to the KDC per Day= 15,000
  8. 8Total Clock Skew Window= 10 minutes
  9. 9Full Re-Authentication Required= No

Assumptions and limits

  • The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to whole numbers, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Kerberos Ticket Lifetime calculated?

renewals per session = ceil(session length ÷ ticket lifetime) − 1, capped by the renewal window; beyond that window the client must authenticate again from scratch. A ticket-granting ticket is valid for its lifetime and can be renewed repeatedly until the renewal window expires. Renewals are cheap TGS exchanges; crossing the renewal ceiling forces a full AS exchange, which needs the user's credential rather than just the existing ticket.

Why does Kerberos Ticket Lifetime matter?

The 10-hour default exists so a stolen ticket expires within a working day, and lengthening it to avoid mid-shift prompts extends exactly that theft window — while a machine more than five minutes out of sync fails Kerberos entirely.

What values do I need to enter?

This calculator takes 5 inputs: Ticket-granting ticket lifetime, Renewal window, Typical user session length, Users authenticating per day, Maximum tolerated clock skew. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why is the Kerberos ticket lifetime 10 hours?

It is chosen to outlast one working day so users are not prompted mid-shift, while guaranteeing that a stolen ticket is useless the next morning. The paired 7-day renewal window lets long-running sessions and services keep renewing for a week without ever re-sending credentials.

What happens if a clock drifts more than five minutes?

Authentication fails with a clock-skew error, because the KDC treats timestamps outside the tolerance as a replay attempt. This is why domain members synchronise time from the domain hierarchy and why a broken NTP source can look exactly like a total authentication outage.

Related Calculators

Kerberos Ticket Lifetime Calculator | Calcrivo