Rate limiters

How a service decides which requests to let through when clients send too many. Each one is shown with two users and an attacker, shared and per-user limits, and sizing from daily active users.

Token Bucket

Tokens refill at a fixed rate up to a cap; each request spends one. Allows short bursts.

Leaky Bucket

Requests wait in a queue that empties at a fixed rate. The server sees a steady stream.

Fixed Window Counter

A count per window that resets at each boundary. Cheap, but bursts around a boundary get through.

Sliding Window Log

Keeps a timestamp for every request in the last window. Exact, but the memory grows with traffic.

Sliding Window Counter

Estimates the last window from two counts. Nearly as smooth as a log, at two numbers of memory.