Adaptive Login Throttling: Brute-Force Defense

Attacker Behavior

Attack rate 4.0 /s

Credential strength 14 bits

Defense Policy

Base backoff delay 300 ms

Lockout threshold 8 fails

Gate Status

Accepting attempts

Next-attempt delay

0 ms

Consecutive fails

0 / 8

Blocked (throttled)

Allowed attempts

How it works

Every failed login increases a per-account failure counter n. The server refuses to even evaluate the next credential until an exponential backoff window has elapsed:

delay(n) = baseDelay · 2ⁿ   (n capped at the lockout threshold)
next_allowed_at = now + delay(n)
if attempt arrives before next_allowed_at → rejected, uncounted
counter resets to 0 after a quiet period with no failures

This is the standard defense against credential-stuffing and brute-force attacks used by SSH (fail2ban), WordPress login-limiting plugins, and cloud IAM services: it does not need to detect the attacker's identity, only the failure rate on one account. As n grows, delay(n) grows exponentially — an attacker sending requests at any fixed rate is throttled down to a vanishing effective guess rate within a handful of failures, while a legitimate user who mistypes a password once or twice barely notices the wait.

Attack rate — how fast the attacker fires guesses (before throttling).
Credential strength — higher entropy means a lower per-attempt chance the guess happens to be correct (illustrative, not a real password model).
Base backoff delay / Lockout threshold — the defense's own tuning: a larger base delay or higher exponent cap slows the attacker faster but can also slow a genuine user who fails a few times.

Green spheres are throttled (rejected before evaluation), amber spheres are evaluated-and-wrong guesses, and a rare cyan flash is a successful guess — watch how quickly the red barrier at the gate closes as the failure counter climbs.

Throttled (blocked) Evaluated, wrong Correct guess (breach)

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.

Adaptive Login Throttling: Brute-Force Defense Simulator