If a user fails to authenticate over and over again his account will be locked due to certain conditions.

But I am wondering, what would be the best practice or a good practice to automatically unlock the account.

I am thinking of this:

Solution A

Should I lock the account for 5 minutes or an hour and totally "ignore" what happens during this hour and allow the account to be usable after this timeout again?


Solution B

Should I take into account what happens during this one hour timeout like: If the account is still brute forced lock the account for another hour.

Can I rely on, that the account would be immediatly locked again after this one hour?

What are your thoughts on this?

2 Answers 2


What you're suggesting is a per-account rate limit: a counter on an individual account.

This article describes a number of different strategies you'll probably want to employ in parallel:

  • per-source rate-limit: limit the rate of login attempts from an IP or IP block to any account
  • per account rate-limit: limit the number of IPs that can attempt to login to a particular account in a given period.
  • global rate-limit: limit the overall maximum number of login attempts from any source to any account

Beware - if you create long lock-out periods like an hour, you make it very easy for an attacker to denial-of-service your users. All they have to do is create some login failures every hour and the user can never login. The combination of rate limits above is a better approach.

Other things that'll make your life easier:

  • implement the rate limit everywhere a user can authenticate - don't forget the "password reset" endpoint that validates the old password. It's very common for applications to rate limit the main login screen but leave other endpoints unlimited.

  • encourage good passwords with an entropy (password strength) meter. Maybe even enforce a certain strength server-side. zxcvbn is excellent and open source.


The goal of such an account locking mechanism is to limit the number of password guesses in a period of time to mitigate brute force attacks. So you should think about how many attempts you want to allow in a certain time frame. Which solution do you use is not so important for security.

  • Thanks for pointing out the baseline requirement "limit the number of password guesses in a period of time".
    – cornelinux
    Commented Jul 8, 2017 at 6:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .