---
title: Sign-in protection
description: What happens after repeated failed sign-ins, and why it is a delay rather than a lockout.
domain: identity
status: shipped
visibility: public
last_verified: 2026-08-01
order: 40
---
Repeated failed sign-in attempts on an account are slowed down automatically.
The first few are free: enough for a mistyped password, a stale saved one, or
picking the wrong of two accounts. After that each further wrong attempt adds a
wait before the next one is accepted, and the wait grows with each attempt. The
sign-in page always tells you exactly how long.

Signing in successfully clears it immediately. If you eventually remember your
password, you are not still serving a delay earned by the attempts before it.

## Why a delay and not a lockout

Locking an account after a set number of failures sounds safer, but it hands
anyone who knows your email address a way to lock your colleagues out on demand.
A growing delay makes guessing pointless without ever leaving a real person shut
out of their own account. Someone who keeps going is slowed to a rate at which
working through even a weak password is hopeless.

The delay also has a ceiling. It gets slow, not permanent.

## What counts

Attempts are counted **per account**, not per device or location. That is
deliberate: automated password guessing is spread across thousands of different
computers precisely so that no single one looks unusual. Counting per account is
what notices it.

Attempts against an address that has no account are counted the same way, so the
sign-in page cannot be used to work out which addresses are registered.

The waits also fade on their own after a quiet spell, so a few failures this
morning are not still slowing you down this afternoon.

## If you are locked out for longer

The wait is always bounded and never becomes a lockout, so if you still cannot
get in:

- Use **Forgot password** to set a new one.
- If you have two-factor authentication on and have lost both your authenticator
  and your recovery codes, contact support. See
  [Two-factor authentication](two-factor-authentication).

## Related

- [Two-factor authentication](two-factor-authentication)
- [Team members](team-members)