Sessions last 14 days. Repeated failures from one address are locked out for 15 minutes.