Rate Limit Threshold Calculator

Work out rate limit threshold instantly with clear inputs, formula shown and shareable results.

About Rate Limit Threshold Calculator

A rate limit should sit above the p99 of genuine per-user behaviour so real users never hit it, typically at two to five times that figure. The check that is usually skipped is aggregate: if every active user ran at the cap simultaneously, the backend must still survive. When it cannot, the per-user limit is decoration and a global concurrency limit is also required.

Formula

Rate limit sizing

per-user limit = p99 per minute x safety multiplier; worst-case backend load = users x limit / 60

Worked example

With the default values below, Rate Limit Threshold Calculator returns Per-user rate limit of 120. Change any input above and every figure here is recalculated in your browser.

Inputs used

p99 legitimate requests per user per minuteminimum 0.1: 40
Safety multiplier above p99accepts 1–20 x: 3 x
Concurrent active usersminimum 1: 12,000
Backend capacityminimum 0.1 req/s: 5,000 req/s

Results

Per-user rate limit: 120 req/min
Backend load if every user hits the cap: 24,000 req/s
Backend utilisation in that worst case: 480.0%
Assessment: Per-user limit is too generous - all users at the limit would overwhelm the backend

Step by step

1Values used
2Rate limit sizing
3Per-user rate limit= 120 req/min
4Backend load if every user hits the cap= 24,000 req/s
5Backend utilisation in that worst case= 480.0
6Assessment= Per-user limit is too generous - all users at the limit would overwhelm the backend

Assumptions and limits

The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Should limits be per user or per IP?

Both. Per-user limits stop credential-based abuse; per-IP limits catch unauthenticated traffic, though NAT and carrier-grade NAT mean per-IP limits must be more generous.

Which algorithm should be used?

A token bucket allows short bursts while capping the sustained rate, which matches real client behaviour far better than a fixed window that resets abruptly.