To my understanding, it is common security practice to lock the account after X failed login attempts in N minute. Usually, the account will be locked for M minutes.

I noticed that most of the time X is 3 and usually the account needs a reset by the system admin. Now my question is why X most of the time 3? and are there any methods we should follow to figure out accepted values for N and M.

I am mainly asking this in case of access controls systems that are not using password-based protection but other factors like behavioural biometrics or context-based authentication

2 Answers 2


It depends upon environment and intent.

High security environments often use 3 failures to lock and require contacting an admin and verifying your identity to unlock.

More automated systems may use 5 failures with a timed unlock after some time, typically in the region of 15 minutes to 1 hour.

I usually set Fail2ban to block remote access after 5 failures within 5 minutes with a timeout unblock of 30 minutes, under the theory that if a person screws up 5 times then waiting 30 minutes to try again is acceptable but 30 minutes is long enough to send brute force bots along their way as not viable.


With non-passwored mechanism like biometrics, behavioural biometrics or context, it depends on the failure mode of the mechanism.

With pure biometric authentication, like voice recognition, the mechanism fails when the person's voice changes due to natural causes, such as a head-cold. A sequence of failures should take them to a human with a different way of verifying the person, such as a zoom call. The mechanism should also "learn" each of the expected changes, so that when the person recovers, they don't get locked out again.

That's wildly different from passwords, where you are trying to deal with password-guessing as a failure mode!

Behavioral biometrics, such as typing cadence, need to be proven to have a success mode. In other words, they sound more that a little bit like snake oil.

Context fails when your context changes, such as when I move from my mail work machine to my laptop. I wouldn't consider it as an authentication mechanism at all: anyone could steal my laptop and pretend to be me.

Finally, these three might make useful reauthentication checks, applied after the person has authenticated to ensure the same person is using the login, and someone else has not taken it over. All would need to fail immediately to a human verifier, or they would constitute a self-inflicted a denial-of-service attack.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .