4 ms·

I'm no security expert, but this would let someone try two unrelated passwords at once and so probably wouldn't be done client-side.

• the_gipsy 5y ago
  Ouch, you are right.
• iso1210 5y ago
  In practice is there really any difference between allowing a client to try 10 passwords before 'lock out' (say no more attempts for 10 minutes), or try 5 passwords before hand.