Sudo Timeout Calculator

Work out sudo timeout instantly with clear inputs, formula shown and shareable results.

About Sudo Timeout Calculator

sudo caches successful authentication per terminal for timestamp_timeout minutes, defaulting to 15 on most distributions. The trade-off is direct: a shorter window means more prompts but a smaller period in which an unattended or hijacked terminal grants root without a password. Setting it to 0 requires a password every time.

Formula

Prompt frequency

if the gap between commands exceeds the timeout, every command prompts; otherwise prompts ~ ceil(session duration / timeout)

Worked example

With the default values below, Sudo Timeout Calculator returns Password prompts per session of 3. Change any input above and every figure here is recalculated in your browser.

Inputs used

timestamp_timeoutaccepts 0–1,440 min: 15 min
Privileged commands per sessionminimum 1: 12
Minutes between commandsminimum 0.01 min: 3 min
Seconds to enter a passwordminimum 0.1 s: 6 s

Results

Password prompts per session: 3
Time spent entering passwords: 18.0 s
Window where sudo needs no password: 15 min
Security trade-off: Balanced setting

Step by step

1Values used
2Prompt frequency
3Password prompts per session= 3
4Time spent entering passwords= 18.0 s
5Window where sudo needs no password= 15 min
6Security trade-off= Balanced setting

Assumptions and limits

The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Is the timestamp per terminal or per user?

Per terminal by default via tty_tickets, so authenticating in one shell does not grant access in another. Disabling tty_tickets makes it per user and is less safe.

Should NOPASSWD ever be used?

Only for specific tightly scoped commands used by automation, never for ALL. A NOPASSWD entry for a shell or an editor is equivalent to passwordless root.