Getting in / Pair 08 of 41

Rate limiting against a password that no longer matches

You type the password you have always typed and the form comes back empty. That can be a tally that stopped reading, or it can be a value that no longer matches.

Why the refusal looks identical

A login form has one job and one way of reporting failure. It clears the fields and shows the same short line whatever went wrong. Operators keep it that way deliberately. A page reading your password is fine but you have knocked too often would be telling anyone who landed on it that the account name exists and that the value they hold is good. So the refusal is flat by design.

That flatness is what drops these two into the same bucket. One refusal is produced by a tally. The other is produced by a comparison. From the outside you get the same grey box and the same empty field, and no amount of staring at it will separate them.

Rate limitingA

A counter sitting in front of the check

The market keeps a running tally of recent attempts against your account name or your session and refuses once that tally passes a line. It does not compare your password with anything. The answer you get is a decision about how often you have knocked, not about what you knocked with.

A wrong passwordB

A comparison that came back no

The market did read what you sent, held it against the stored value and found no match. This turns up with a saved password that went stale, a keyboard layout you did not expect, or a character that a copy and paste quietly dropped.

Where the decision is actually made

A limiter runs before the credential check. It reads the account name, or the session, counts what has happened recently, and returns a refusal without ever looking at the rest of what you sent. A failed comparison is the reverse. Nothing was counted at all. Something was read very carefully and it did not match.

That difference matters, since only one of the two can be fixed by typing. Every attempt against a limiter pushes the number up. Every attempt against a genuine mismatch is at least asking the right question.

The thing that tells them apart

Wait, then spend one attempt

Sit still for longer than the window the site is likely to be using, then make exactly one attempt with a password you would put money on. If that single attempt is refused as well, the counter was never the point.

Close the login tab. No refreshes, no half attempts, nothing typed into the form.
Leave it for a good stretch. Long enough that you are guessing high rather than low.
Come back and get the password out of wherever you actually store it, rather than out of your head.
Make one attempt. One. Then read what you get and stop either way.

Two things make that reading trustworthy. The wait has to genuinely pass, and the attempt has to be one you would bet on. A hopeful guess that fails leaves you unable to say which half you just tested.

The refusal arrives quicker than the page used to answer. A comparison takes a moment of work. A tally does not.
It started after a run of fast attempts rather than after a long break.
A fresh session refuses in exactly the same way, which points at something held against the account rather than against the tab you were in.
Nothing about the password changed since the last time it worked, and nothing about the machine changed either.

The cheap error and the expensive one

If you treat the counter as a bad password: You start altering something that was never wrong. Each variant feeds the tally, the wait widens, and sooner or later you go looking for a reset link while irritated, which is the worst possible frame of mind for choosing an address.
If you treat a bad password as the counter: You wait out a window that was never running, then wait again. The loss is an evening rather than an account, and nothing you did made the situation worse.

Sitting still when you did not need to costs you time. Typing when you should have sat still can end with a locked account and a hurried recovery, and hurried recovery is how people end up entering credentials on an address somebody else picked for them. The same argument for every other pair is collected in the cost table.

What each one wants from you next

If it is rate limiting: Leave it entirely alone. Come back later and make a single attempt. Nothing else you can do from your side shortens the wait, and several things lengthen it.
If it is a wrong password: Work out where the wrong value is coming from before you type again. Then use the recovery the market itself offers, reached from the address you already held rather than one you have just found.

Neither of these is a reason to go hunting for a different entrance. This site monitors nothing, so a login that refuses you proves nothing whatever about an address. The frame behind the pairs is set out in how pairs work, and the nearest neighbour is locked out against taken.

Questions readers send about this pair

How long does a rate limit last?

Nobody outside the operation knows, and it is rarely a fixed number. Limiters commonly widen the wait as attempts pile up, so the honest answer is that the window in front of you now is longer than the one you faced an hour ago. Stopping is the only thing on your side that shortens it.

Can a wrong password look like a wait?

Yes. Plenty of forms slow every failed comparison on purpose so that timing gives nothing away. A slow refusal on its own is not evidence of a counter, which is why the wait and the single careful attempt do the work instead.

Should I request a password reset straight away?

Not while you are unsure. A reset is worth doing once you have decided the comparison is genuinely failing, and it is worth starting from the address you already had.