--- title: "Slow down password guessing ยท Agent Wranglers" url: https://agentwranglers.se/playbook/application-security/authentication-and-sessions/login-guessing id: APS-10 level: Required applies: accounts risk: takeover updated: 2026-10-27 build: a2a6bdfed830 tokens: 934 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Slow down password guessing For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Authentication and sessions](https://agentwranglers.se/playbook/application-security/authentication-and-sessions.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: APS-10 - Level: Required - Chapter: [Authentication and sessions](https://agentwranglers.se/playbook/application-security/authentication-and-sessions.md) - Rule: Limit failed logins per account and per client address. Give the same error for a wrong user and a wrong password. - Check: On the test copy, send 20 wrong passwords to one test account in a minute. Tries after the fifth are slowed or blocked. The error for an unknown email reads the same as for a wrong password. On a second test account, 101 failures spread over a day never succeed without a reset. - Risk: An account or system taken over - Applies when: The project has user accounts. - How: After 5 failures in a row, add a growing delay or a challenge for that account. Never allow more than 100 failures in a row, as NIST SP 800-63B-4 requires. Rate limit the login route per client address as well, for example at 20 failures a minute. Count failures on every sign-in path, as [hold every sign-in path to the same checks](https://agentwranglers.se/playbook/accounts/sign-in-methods/same-checks-every-path.md) says. Password length, the breached-password list and paste live in [accept long passwords and refuse breached ones](https://agentwranglers.se/playbook/accounts/sign-in-methods/password-rules.md). Offer [two-factor login](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/two-factor-login.md) as well. ## Sources - [NIST SP 800-63B-4 on rate limiting](https://pages.nist.gov/800-63-4/sp800-63b.html#throttle) - [OWASP Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html) ## Related rules - ACC-13 [Accept long passwords and refuse breached ones](https://agentwranglers.se/playbook/accounts/sign-in-methods/password-rules.md) in Accounts and identity - ACC-65 [Hold every sign-in path to the same checks](https://agentwranglers.se/playbook/accounts/sign-in-methods/same-checks-every-path.md) in Accounts and identity - ACC-79 [Give the same answer for known and unknown accounts](https://agentwranglers.se/playbook/accounts/sign-in-methods/no-account-enumeration.md) in Accounts and identity - ACC-70 [Offer two-factor login](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/two-factor-login.md) in Accounts and identity - APS-49 [Limit how often anyone can call your APIs](https://agentwranglers.se/playbook/application-security/limits-and-business-logic/rate-limits.md) in Application security - APS-50 [Take the client address only from proxies you run](https://agentwranglers.se/playbook/application-security/limits-and-business-logic/trusted-proxy-client-address.md) in Application security **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers application security playbook`. In code you write, add a comment next to it with the same link. - Next: [Store passwords with a slow hash](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/password-storage.md) - [Authentication and sessions](https://agentwranglers.se/playbook/application-security/authentication-and-sessions.md)