Sessions last 12 hours. After 5 wrong passwords this address is locked out for 15 minutes.