Usually feels like
Minutes
You stay at the keyboard and it finishes there.
Limiters of this kind usually release at the keyboard, but only for somebody who stops attempting, because attempts made during the wait tend to restart it.
The wait, in plain words
After a run of failed attempts the sign in page stops arguing and starts refusing. The wording is usually short. Too many attempts, try again later, and no indication whatever of how much later.
This is not a fault and it is not aimed at you personally. It is a limiter, and the fact that it will not tell you when it ends is part of how it does its job.
It belongs in this band because most limiters of the kind release while you are still sitting there, provided you leave them alone. Left alone is doing a great deal of work in that sentence.
Underneath, while nothing moves
Guessing a passphrase is cheap for whoever is guessing and expensive for whoever is defending. The defender cannot make guessing harder without making honest use harder too, with one exception. Time costs an attacker their whole method and costs an honest person one inconvenient evening.
A service reached this way has a further problem. It cannot tell one visitor from another by where they came from, because there is no address to count against. So the counter is attached to whatever the service can actually see, and that choice decides how the cooldown behaves for you.
| What the counter is attached to | What that means while you wait |
|---|---|
| The account name | Trying from another window, another browser or another path does not help. The name is what is being counted. |
| The session or a token | Clearing it can look like an escape, but a fresh session that fails again arrives in the same place faster. |
| The circuit | A new path may move you, and it also presents you to the front layer as a stranger who has just turned up. |
| The endpoint itself | Everybody is being slowed at once, and nothing you do on your own changes any of it. |
The other half of the design is backoff. A limiter that always waited the same amount would be a small tax an attacker could budget for, so the wait grows with each failure, usually by multiplying rather than by adding. A long enough run of attempts takes the wait out of this band entirely.
Worse for the impatient: many implementations restart the clock on any attempt made during the cooldown. Not just a wrong attempt. Any attempt. A cooldown you keep poking is a cooldown you keep restarting, and it is entirely possible to sit there typing the correct passphrase every time and never once be let in.
None of that is visible from your side. A limiter that is counting down and a limiter that has just been reset by your last press show the same page and say the same sentence. There is no display because a display would tell a machine exactly when to come back, which is the one thing the whole arrangement exists to withhold.
Behaving, and not behaving
At some point a cooldown stops being a cooldown, and the wording is usually what gives it away.
A cooldown running down
The message talks about time. Too many attempts, wait, try later. The form is still on the page even if it will not accept anything you put in it.
Leaving it completely alone for a while and coming back once gets you an ordinary sign in page again.
Something that is no longer a limiter
The wording has changed from waiting to a decision. Locked, suspended, contact support. Time is not mentioned anywhere.
Or the wait keeps growing however long you stay away, which means something is still making attempts that you are not making.
That second case has a mundane explanation worth ruling out before anything dramatic. Something else is signing in as you on a schedule: a saved session somewhere, a script, a browser reopening a tab every time it starts. The fix for that is to stop it, not to try harder.
A message that has turned into a decision is a different wait with no ceiling in it, covered by an account locked without a reason. Before assuming you are there, be sure the attempts themselves were sound, because the pause after you press sign in is easy to read as a rejection when it is nothing of the kind.
Safe to do meanwhile
The correct behaviour here is unusual for this site. Do nothing at all, and do it properly.
- Close the tabA tab that stays open is a tab somebody eventually clicks.
- Write down the exact wording of the messageIt is the only thing that will tell a limiter from a lock when you come back to it.
- Check the name and passphrase away from the formSettle what you believe them to be before spending another attempt on finding out.
- Find something else to do with the waitThe one wait on this site where absence is the entire method.
What makes it longer
Every item below is an attempt that did not have to be made.
- Trying again during the cooldown, which in many designs restarts it from the beginning.
- Trying the same wrong passphrase, which spends an attempt and teaches you nothing new.
- Opening a second window and trying there, since the counter is usually attached to the name rather than the window.
- Rebuilding the path repeatedly, which can put a gate screen in front of you on top of the limiter.
- Opening a ticket about it. Support rarely lifts a limiter, and a ticket runs in a slower band than the cooldown you are complaining about.
What this card is not. This card is not a way around a limit, and there is nothing here that shortens one.
Questions people ask about this wait
Does the timer reset if I try again while waiting?
Often it does. Many limiters count any attempt made during the cooldown, including a correct one, and start the clock over. Stopping entirely is the only approach that reliably ends it.
Does building a new path clear it?
Only if the counter was attached to the path rather than to the account name, and you cannot see from outside which it is. A new path also presents you to the front layer as a stranger.