API Rate Limiter Simulator

Simulate and visualize Token Bucket, Leaky Bucket, Fixed Window, Sliding Log, and Sliding Counter — interactive traffic patterns, compare mode, and code examples.

rate-limitingapithrottlingtoken-bucketsliding-windowbackendarchitecture

Category: Code & Developer Tools

100% local simulation

No API calls — all rate limiter math runs in your browser with React state and timers.

Live visualization
Total
0
Allowed
0
Blocked
0
Success %
100%

Last up to 60 requests — newest on the right

Request log
No requests yet — use Send request or a traffic pattern

A bucket holds tokens up to its capacity. Each request consumes one token. Tokens refill at a fixed rate. When the bucket is empty, requests are rejected until tokens refill.

Pros

  • Allows controlled bursting
  • Smooth average rate
  • Memory efficient — just two numbers

Cons

  • Burst can overwhelm downstream services
  • Distributed implementations need sync
Stripe-style APIsAWS API Gateway patternsShopify-style limits
Try: Try "Burst then steady" — the bucket absorbs the burst until it empties, then blocks until refill.

Why simulate rate limiters?

Production APIs throttle traffic with algorithms that behave very differently under bursts, retries, and clock boundaries. Reading docs alone rarely builds intuition. This simulator runs real implementations in your browser so you can fire traffic, watch allow vs block decisions, and compare five major strategies side by side.

Algorithms included

  • Token bucket — refill tokens over time; allows controlled bursts.
  • Leaky bucket — queue drains at a fixed rate; smooths traffic.
  • Fixed window counter — simple counter per time slice; watch boundary bursts.
  • Sliding window log — exact counts using timestamps; higher memory.
  • Sliding window counter — weighted previous + current window; popular Redis-style approximation.

How to use this tool

  1. Pick an algorithm tab and tune capacity, rates, or window size.
  2. Send single requests, bursts, or enable auto-fire at a chosen rate.
  3. Run a traffic pattern preset (for example “Window boundary attack” with a 10-second window) to see fixed-window edge cases.
  4. Enable Compare mode to fan the same requests into all five limiters and inspect the success table.
  5. Expand Code snippets for JavaScript, Python, Go, or Redis-style notes.

Is data sent to a server?

No. The simulation uses React state and timers only. Nothing is uploaded; you can use it offline after the page loads.

Frequently Asked Questions

Which algorithm should I use in production?

It depends on fairness vs cost. Token bucket is common for burst-friendly APIs; sliding window counter is a strong memory-efficient approximation; sliding log is most accurate when you can afford storing timestamps.

Are the “real API” presets exact copies of those APIs?

No. They are illustrative starting points for learning. Real providers add headers, multiple dimensions (per key vs per IP), and dynamic limits.

What is a window boundary attack?

With fixed windows, a client can send many requests just before a window resets and again just after, receiving twice the steady allowance in a short wall-clock span. Try the preset with a 10-second window to see it.

Tips

Quick guidance for using our tools safely and effectively.

Privacy

Files are processed on the server for conversion only and are not used for training or shared with third parties.

Best results

Use the formats suggested in each tool. Large media files may take longer — keep the tab open until processing finishes.

Need something else?

Browse related tools below or explore other categories from the main Dev Tools hub.