Lockout Policy Calculator
A lockout does not make a secret stronger. It converts an unlimited guessing rate into a fixed one, and that is a completely different calculation from how long a stolen hash resists cracking. It is also why a four-digit PIN behind a strict lockout can be safer than a long password with no rate limiting at all — the attacker never gets to try.
What this generator does
Turns an attempts-and-lockout policy into a guessing rate, then works out how long an attacker would take to exhaust the space and what chance a day of sustained guessing gives them.
How to use this tool
- Set how many attempts are allowed and how long the lockout lasts.
- Choose what is being guessed — a PIN, a code, a short password.
- Read the guesses per hour: that is the entire effect of the policy.
- Compare a strict policy against a lax one on the same secret.
Understanding the controls
- Attempts allowed
- How many failures before the account locks. Every attempt after that costs the attacker the full lockout period.
- Lockout duration
- How long the lock lasts. This is the number that actually throttles the attack — doubling it halves the guessing rate.
- What is being guessed
- The size of the space matters as much as the policy. A four-digit PIN is ten thousand possibilities; a six-character alphanumeric code is over two billion.
Common use cases
- Choosing a lockout policy that is strict enough to matter
- Justifying why a short PIN is acceptable behind rate limiting
- Showing that lockout and password strength solve different problems
- Explaining an authentication design decision
- Teaching the difference between online and offline attacks
How this generator works
The rate is simply the attempts allowed divided by the lockout period, and the check confirms it works in both directions: that rate multiplied by the reported time to exhaust must give back the size of the space. That catches an error in either figure, which recomputing one from the other would not.
Randomness and fairness
Nothing here is random. The whole calculation follows from the policy and the size of the space you choose.
For how randomness is produced across the whole site, see how Generate Random works.
Limitations and good to know
- One account. An attacker spreading guesses across many accounts — password spraying — is not throttled by a per-account lockout at all.
- Assumes the attacker waits out every lockout perfectly, which is the worst case rather than the typical one.
- A lockout is also a way to deny a legitimate user their account, and that cost is real but not quantified here.
- Says nothing about credential stuffing, where the attacker already has a likely password and needs very few guesses.
Privacy and your data
The calculation runs entirely in your browser. Nothing you enter is transmitted or stored.
Related generators
- Password Entropy CalculatorHow many bits a password actually carries, what that costs an attacker at four realistic speeds, and how many random words match it.
- Authenticator Code Window CalculatorHow many authenticator codes are valid at once, and exactly what widening the window to forgive clock drift costs.
- Key Stretching CalculatorTurns an iteration count into the time a login costs you and the guessing rate it leaves an attacker, and inverts it to hit a target.
- Rate Limit Scenario GeneratorThe ways rate limiting actually bites — missing Retry-After, per-key budgets, silent throttling — with the expected client behaviour for each.