https://nalar.dev/tags/login-throttling/ Recent content in Login Throttling on Nalar Hugo en-us Sat, 05 Sep 2026 00:00:00 +0700 https://nalar.dev/slow-down-automated-login-attacks/ Sat, 05 Sep 2026 00:00:00 +0700 https://nalar.dev/slow-down-automated-login-attacks/ <p>A password login endpoint has to accept attempts from people who sometimes mistype their passwords. The same property also gives automated clients a place to try many guesses. If the application processes every attempt at full speed, an attacker can repeatedly test passwords against one account or spread attempts across many accounts.</p> <p>A correct password hash does not solve this problem. Password hashing makes each password verification deliberately costly, but the server still has to decide how many online attempts it will accept. Without another control, the application may provide an attacker with a large number of guesses over time.</p>