# How can I protect my Vaultwarden account from brute-force attacks? **URL:** \ **Category:** Help\ **Created:** [November 9, 2023, 7:30am UTC](https://vaultwarden.discourse.group/t/how-can-i-protect-my-vaultwarden-account-from-brute-force-attacks/3067 "2023-11-09T07:30:34Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![NordSig](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/nordsig/32/1145_2.png) [@NordSig](https://vaultwarden.discourse.group/u/NordSig)\ **Post date:** [November 9, 2023, 7:30am UTC](https://vaultwarden.discourse.group/t/how-can-i-protect-my-vaultwarden-account-from-brute-force-attacks/3067/1 "2023-11-09T07:30:34Z")
**How can I protect my server accounts from password brute force?** Bitwarden’s FAQ has such a question and answer ([Emails from Bitwarden | Bitwarden Help Center](https://bitwarden.com/help/emails-from-bitwarden/#failed-login-attempts-detected)): > ### How can I protect my Bitwarden account from brute-force attacks? > > **A:** A brute-force attack is when a malicious actor cycles through a combination of weak and short passwords in an attempt to gain access to your account. Bitwarden offers a few ways you can protect yourself from these potential attacks: > > - Have a long and unique master password. Bitwarden requires a 12 character minimum to increase account security. > - Set up [2FA](https://bitwarden.com/help/bitwarden-field-guide-two-step-login/) on all Bitwarden accounts to add an additional layer of security. > - Bitwarden will require CAPTCHA verification after 9 failed login attempts from an unknown device. Bitwarden’s website has an article about sending an email when a login attempt fails ([Emails from Bitwarden | Bitwarden Help Center](https://bitwarden.com/help/emails-from-bitwarden/#failed-login-attempts-detected)): **1. Vaultwarden does not have captcha?** **2. Vaultwarden can’t send emails on failed login attempt?** ---
**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\ **Post date:** [November 9, 2023, 8:45am UTC](https://vaultwarden.discourse.group/t/how-can-i-protect-my-vaultwarden-account-from-brute-force-attacks/3067/2 "2023-11-09T08:45:12Z")
> **1. Vaultwarden does not have captcha?** We do not indeed, if i’m correct this is not active for self-hosted instances, even the Bitwarden Self-Hosteds). We do have a rate-limit on this, so that should prevent brute-force attacks. See: > > **2. Vaultwarden can’t send emails on failed login attempt?** We currently do not indeed. We do for successful logins from unknown devices. But this is a nice feature to add, ill put it on the list. ---
**Author:** ![NordSig](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/nordsig/32/1145_2.png) [@NordSig](https://vaultwarden.discourse.group/u/NordSig)\ **Post date:** [November 9, 2023, 8:58am UTC](https://vaultwarden.discourse.group/t/how-can-i-protect-my-vaultwarden-account-from-brute-force-attacks/3067/3 "2023-11-09T08:58:06Z")
**Thank you for your answers.** 1. That’s right, now the limit on the number of login attempts is triggered on failed login attempts. What should I specify for LOGIN\_RATELIMIT\_SECONDS and LOGIN\_RATELIMIT\_MAX\_BURST so that after 10 failed login attempts, the next one will be in 5 minutes? 2. This is a great option. We hope it will be added soon. Thx. ---
**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\ **Post date:** [November 9, 2023, 9:18am UTC](https://vaultwarden.discourse.group/t/how-can-i-protect-my-vaultwarden-account-from-brute-force-attacks/3067/4 "2023-11-09T09:18:01Z")
If i’m correct from the top of my head that would be: `LOGIN_RATELIMIT_SECONDS=300` `LOGIN_RATELIMIT_MAX_BURST=10` And i set 10 here, but keep in mind that since you use 2FA, which causes the clients to call that endpoint a second time within those 5 minutes. Also note, we do this for every attempt, not only failed logins, because someone could also try to use invalid logins or try multiple etc… So, this does mean that if you login from the same IP on 5 different devices which all need to enter a 2FA within 5 minutes, that after that you can’t login anymore, and need to wait for 5 minutes to try again. ---
**Author:** ![NordSig](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/nordsig/32/1145_2.png) [@NordSig](https://vaultwarden.discourse.group/u/NordSig)\ **Post date:** [November 9, 2023, 9:48am UTC](https://vaultwarden.discourse.group/t/how-can-i-protect-my-vaultwarden-account-from-brute-force-attacks/3067/5 "2023-11-09T09:48:30Z")
**Does this work for the IP-account vaultwarden mapping?** For example: I have 50 users, they who log in from the same IP (NAT) in vaultwarden. User ([user1@email.com](mailto:user1@email.com)) entered 10 times wrong password. Will only [user1@email.com](mailto:user1@email.com) or all users get login restriction (5 minutes)? ---
**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\ **Post date:** [November 9, 2023, 9:51am UTC](https://vaultwarden.discourse.group/t/how-can-i-protect-my-vaultwarden-account-from-brute-force-attacks/3067/6 "2023-11-09T09:51:23Z")
It’s per IP. Nothing else is used to match it. Else an attacker could just switch between multiple accounts if they know more accounts on a specific deployment exists. > ---
**Author:** ![gerardv514](https://avatars.discourse-cdn.com/v4/letter/g/439d5e/32.png) [@gerardv514](https://vaultwarden.discourse.group/u/gerardv514)\ **Post date:** [September 14, 2024, 11:42pm UTC](https://vaultwarden.discourse.group/t/how-can-i-protect-my-vaultwarden-account-from-brute-force-attacks/3067/7 "2024-09-14T23:42:57Z")
As per the meta thread, I think it would be a good idea to allow email notification on failed attempts, just like we get email notifications on successful attempts. If this is just a notification about a failed login, how can that be abused? ---
**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\ **Post date:** [September 15, 2024, 3:54pm UTC](https://vaultwarden.discourse.group/t/how-can-i-protect-my-vaultwarden-account-from-brute-force-attacks/3067/8 "2024-09-15T15:54:32Z")
If i know your mail address, i can bomb your mail address with all these attempts. It might fill your mailbox etc… etc… ---
**Author:** ![gerardv514](https://avatars.discourse-cdn.com/v4/letter/g/439d5e/32.png) [@gerardv514](https://vaultwarden.discourse.group/u/gerardv514)\ **Post date:** [September 18, 2024, 1:04am UTC](https://vaultwarden.discourse.group/t/how-can-i-protect-my-vaultwarden-account-from-brute-force-attacks/3067/9 "2024-09-18T01:04:19Z")
Wouldn’t the rate limit then kick in. At least at that point hey I know there’s some failed attempts going due to notifications and I’m already working on shutting it down to the outside world until it can be looked into more. ---
**Author:** ![thisisroot](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/thisisroot/32/1623_2.png) [@thisisroot](https://vaultwarden.discourse.group/u/thisisroot)\ **Post date:** [January 27, 2025, 8:31am UTC](https://vaultwarden.discourse.group/t/how-can-i-protect-my-vaultwarden-account-from-brute-force-attacks/3067/10 "2025-01-27T08:31:06Z")
This failed attempt notification can be configured with a Boolean ENV variable, and default can be set as false. If someone wants to receive such emails of any failed login attempt, they can enable this feature. This will resolve your concern of getting spam emails. That way I would know someone found my instance and using my email with wrong password attempts to get in and I can take my server offline or take necessary actions. The email will also log the attempter’s IP address, so I will know where the requests are coming from, and add access rules on my proxy server to block that country or similar. Don’t you think this will be very useful for the privacy concerned user base of Vaultwarden? Thanks a lot for keeping this amazing project going, it’s truly AMAZING! ---
**Author:** ![Darkk69](https://avatars.discourse-cdn.com/v4/letter/d/779978/32.png) [@Darkk69](https://vaultwarden.discourse.group/u/Darkk69)\ **Post date:** [February 2, 2025, 2:37am UTC](https://vaultwarden.discourse.group/t/how-can-i-protect-my-vaultwarden-account-from-brute-force-attacks/3067/11 "2025-02-02T02:37:36Z")
Great idea to add rate limits. I use fail2ban to monitor Vaultwarden’s logs for multiple failed attempts and ban the IP after it reaches the threshold. Fail2ban bans the IP at the network level so the attacker can no longer reach Vaultwarden’s instance. I get notified from fail2ban via e-mail when it bans someone along with full info from the IP using Whois by IP service. Fan2ban also monitor /admin page and bans anyone who tries to access it from the outside. I’ve already set the IP restriction on apache to only allow /admin access on the LAN.