Type the wrong password a few times and many accounts simply stop letting you try. That is an account lockout at work — a quiet defense against attackers trying to guess their way in. Understanding it helps you read what a sudden lockout is really telling you. Our GetMyPassword team explains what a brute-force lockout is and why it matters.
What an account lockout is
A brute-force lockout temporarily blocks an account after several failed login attempts. Instead of letting anyone guess passwords endlessly, the service counts wrong tries and, after a set number, locks the account for a while or until you reset it. The goal is simple: turn off the tap so an attacker cannot keep firing thousands of guesses at your password.
Why it protects you
Automated attacks rely on volume — trying password after password until one works. A lockout breaks that strategy by capping how many attempts are possible before everything stops. For a single account, it makes straightforward brute-force guessing impractical, because the attacker is shut out long before they get through a meaningful list.
Its limits — and what a lockout tells you
- It can be used against you: someone entering wrong passwords on purpose can lock you out, a nuisance known as a lockout denial-of-service.
- It does not stop every attack: “password spraying” tries just a few guesses per account to stay under the limit.
- A surprise lockout is a signal: if you are locked out and you were not trying, someone may be guessing your password.
- The real fix is a strong password and two-factor authentication, not the lockout alone.
A lockout you did not cause is a smoke alarm: it means someone has been trying your door. The right response is not just to wait it out, but to change to a strong, unique password and switch on two-factor authentication.
Make lockouts almost irrelevant
A lockout is a backstop, not your main defense. The surest way to defeat guessing is to give every account a long, random password from our password generator and turn on two-factor authentication. With a password that is not on anyone’s guessing list and a second factor behind it, an attacker never gets close enough for a lockout to matter.
Frequently asked questions
What is a brute-force lockout?
It is a defense that temporarily blocks an account after several failed login attempts, so an attacker cannot keep guessing passwords. After a set number of wrong tries, the account locks for a time or until you reset it.
Why am I suddenly locked out of my account?
It can be your own mistyped passwords, but if you were not trying to log in, it may mean someone else is guessing your password. Treat an unexpected lockout as a warning and change to a strong, unique password with two-factor authentication.
Does a lockout make my account fully safe?
No. It slows brute-force guessing on one account, but attacks like password spraying try only a few common passwords per account to stay under the limit. A strong, unique password and two-factor authentication are the real protection.