Why do I have to wait after a wrong password, and what if my account is locked?

Waiting between tries

After a wrong password or two-step code, the next try must wait. By default the waits are 30 seconds, 1 minute, 2 minutes and then 5 minutes each time. The Sign in button counts down.

When three tries or fewer are left before the account locks, the page says so. By default, wrong passwords and wrong two-step codes count together, and a wrong try is remembered for an hour.

When the account locks

By default the account locks after 5 wrong tries. We e-mail the account's address with what happened and how to get back in. By default, browsers that were already signed in carry on.

The sign-in page offers the ways back:

• Choose a new password: the e-mailed link unlocks the account and signs out every other device.
• Recover my account: when you cannot use the e-mailed link or your two-step code.
• Support can also unlock it: reply to the e-mail we sent.

On some set-ups the lock ends by itself after some minutes instead. The message tells you when.

Signing in from a known device

A device and network you fully signed in from recently, or a remembered device, can still sign in during a lock with the right password (and two-step code). That also ends the lock, and we e-mail you. Too many wrong tries from there close that way in too.

"Too many failed sign-ins from your network"

Many failed sign-ins from one internet address block new tries from that address for a while, whichever account they were for. The message says how many minutes to wait.

Is the answer different for an address with no account?

No. The answers and waits are the same whether or not an account exists, so nobody can use the sign-in page to find out who has one.