---
title: "Slow down password guessing · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/login-guessing
updated: 2026-10-20
licence: "All rights reserved"
---

# Slow down password guessing

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)
- Rule: Limit failed logins per account and per address, and refuse passwords known from breaches.
- How: After 5 failures in a row, add a growing delay or a challenge for that account. Never allow more than 100 failures in a row, as NIST SP 800-63B-4 requires. Rate limit the login route per client address as well, for example at 20 failures a minute. Check new passwords against a breached list, such as the Have I Been Pwned range API. Give the same error for a wrong user and a wrong password. Require at least 15 characters when the password is the only factor, and 8 with a second factor. Allow at least 64 characters and pasting. Drop forced symbols and regular expiry. Offer [two-factor login](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/two-factor-login) as well.
- Check: Send 20 wrong passwords to one test account in a minute. Tries after the fifth are slowed or blocked. The error for an unknown email reads the same as for a wrong password. Setting the password `passwordpassword` is refused as breached.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/login-guessing`.

- Previous: [Deny by default](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/deny-by-default)
- Next: [Store passwords with a slow hash](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/password-storage)
- [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)