@@ -1215,6 +1215,18 @@ export default class ConfigValidator implements IConfigValidator {
         newConfig.auth.beforeLoginAttempt = bla;
       }
 
+      // normalize afterLoginFailed hooks
+      const alf = this.inputConfig.auth.afterLoginFailed;
+      if (!Array.isArray(alf)) {
+        if (alf) {
+          newConfig.auth.afterLoginFailed = [alf];
+        } else {
+          newConfig.auth.afterLoginFailed = [];
+        }
+      } else {
+        newConfig.auth.afterLoginFailed = alf;
+      }
+
       // normalize beforeLoginConfirmation hooks
       const blc = this.inputConfig.auth.beforeLoginConfirmation;
       if (!Array.isArray(blc)) {
 
@@ -2,6 +2,8 @@ import {
   type IAdminForth, 
   type IHttpServer,
   BeforeLoginAttemptFunction,
+  AfterLoginFailedFunction,
+  LoginFailureReason,
   BeforeLoginConfirmationFunction,
   BeforeLogoutFunction,
   AdminForthResource,
@@ -598,6 +600,21 @@ export default class AdminForthRestAPI implements IAdminForthRestAPI {
     return null;
   }
 
+  /**
+   * Runs afterLoginFailed hooks. Hooks can't change the 401 response, they are called for logging only.
+   */
+  async processAfterLoginFail ed(username: string, pk: string | null, reason: LoginFailureReason, extra: HttpExtra) {
+    const afterLoginFailed =this.adminforth.config.auth.afterLoginFailed as (AfterLoginFailedFunction[] | undefined);
+
+    for (const hook of listify(afterLoginFailed)) {
+      try {
+        await hook({ username, pk, reason, adminforth: this.adminforth, extra });
+      } catch (e) {
+        afLogger.error(`Error in afterLoginFailed hook, continuing with failed login response: ${e}`);
+      }
+    }
+  }
+
   async processLoginCallbacks(adminUser: AdminUser, toReturn: { redirectTo?: string, allowedLogin:boolean, error?: string }, response: any, extra: HttpExtra, sessionDuration?: string) {
     const beforeLoginConfirmation = this.adminforth.config.auth.beforeLoginConfirmation as (BeforeLoginConfirmationFunction[] | undefined);
 
@@ -672,14 +689,14 @@ export default class AdminForthRestAPI implements IAdminForthRestAPI {
         const userResource = this.adminforth.config.resources.find((res) => res.resourceId === this.adminforth.config.auth.usersResourceId);
         const usernameColumn = userResource.columns.find((col) => col.name === this.adminforth.config.auth.usernameField);
         const normalizedUsername = normalizeColumnValue(usernameColumn, username);
+        const extra: HttpExtra = { body, headers, query, cookies, requestUrl, response };
 
         // hooks are called before any lookup in database, so rejected attempt looks the same
         // for existing and non-existing users (e.g. captcha check should not leak valid credentials)
-        const loginAttemptError = await this.processBeforeLoginAttempt(normalizedUsername, {
-          body, headers, query, cookies, requestUrl, response
-        }, tr);
+        const loginAttemptError = await this.processBeforeLoginAttempt(normalizedUsername, extra, tr);
         if (loginAttemptError) {
           response.setStatus(401);
+          await this.processAfterLoginFailed(normalizedUsername, null, 'rejected', extra);
           return loginAttemptError;
         }
 
@@ -709,41 +726,42 @@ export default class AdminForthRestAPI implements IAdminForthRestAPI {
 
         if (!userRecord) {
           response.setStatus(401);
+          await this.processAfterLoginFailed(normalizedUsername, null, 'user_not_found', extra);
           return { error: INVALID_MESSAGE };
         }
 
+        const pk = userRecord[userResource.columns.find((col) => col.primaryKey).name];
         const passwordHash = userRecord[this.adminforth.config.auth.passwordHashField];
         const valid = await AdminForthAuth.verifyPassword(password, passwordHash);
         if (valid) {
-          adminUser = { 
+          adminUser = {
             dbUser: userRecord,
-            pk: userRecord[userResource.columns.find((col) => col.primaryKey).name], 
+            pk,
             username: normalizedUsername,
           };
 
-          const expireInDuration = rememberMe 
+          const expireInDuration = rememberMe
             ? (this.adminforth.config.auth.rememberMeDuration || '30d')
             : '1d';
 
-          await this.processLoginCallbacks(adminUser, toReturn, response, { 
-            body, headers, query, cookies, requestUrl, response
-          }, expireInDuration);
+          await this.processLoginCallbacks(adminUser, toReturn, response, extra, expireInDuration);
 
           if (toReturn.allowedLogin) {
-            
+
             await this.adminforth.auth.setAuthCookie({
               expireInDuration,
               response,
               username: normalizedUsername,
-              pk: userRecord[userResource.columns.find((col) => col.primaryKey).name],
-              extra: { body, headers, query, cookies, requestUrl, response },
+              pk,
+              extra,
             });
-          } 
+          }
         } else {
           response.setStatus(401);
+          await this.processAfterLoginFailed(normalizedUsername, pk, 'invalid_password', extra);
           return { error: INVALID_MESSAGE };
         }
-          
+
 
         return toReturn;
     }
 
@@ -1225,6 +1225,44 @@ export type BeforeLoginAttemptFunction = (params: {
   tr: ITranslateFunction,
 }) => Promise<{ ok: boolean, error?: string }>;
 
+/**
+ * Why password login attempt failed:
+ * - `rejected`: one of `auth.beforeLoginAttempt` hooks rejected the attempt, credentials were not checked
+ * - `user_not_found`: there is no user with such username
+ * - `invalid_password`: user exists, but password is wrong
+ */
+export type LoginFailureReason = 'rejected' | 'user_not_found' | 'invalid_password';
+
+/**
+ * Called after password login attempt failed, right before AdminForth answers with `401`.
+ * Not called for attempts blocked by `auth.rateLimit`.
+ * Useful to log failed attempts or to notify user about bruteforce of their account.
+ *
+ * Can't change response of the login request: thrown error is logged and login still answers with `401`.
+ */
+export type AfterLoginFailedFunction = (params: {
+  /**
+   * Username which user tried to login with, normalized in same way as it is stored in database.
+   */
+  username: string,
+  /**
+   * Primary key of user with such username. Is `null` when reason is `rejected` or `user_not_found`.
+   */
+  pk: string | null,
+  /**
+   * Why login attempt failed.
+   */
+  reason: LoginFailureReason,
+  /**
+   * Adminforth instance.
+   */
+  adminforth: IAdminForth,
+  /**
+   * Extra HTTP information of login request.
+   */
+  extra: HttpExtra,
+}) => Promise<void>;
+
 /**
  * Called when user logs out, before AdminForth removes auth cookie.
  * Useful for cleanup of things issued for the session (e.g. revoking tokens on external identity provider,
@@ -1804,6 +1842,23 @@ export interface AdminForthInputConfig {
        */
       beforeLoginAttempt?: BeforeLoginAttemptFunction | Array<BeforeLoginAttemptFunction>,
 
+      /**
+       * Function or functions which will be called after password login attempt failed, right before
+       * AdminForth answers with `401`. Not called for attempts blocked by `auth.rateLimit`.
+       * Use them to log failed attempts. Hooks can't change the response, thrown errors are logged.
+       *
+       * Example:
+       *
+       * ```ts
+       * afterLoginFailed: async ({ username, pk, reason, adminforth, extra }) => {
+       *   if (reason === 'invalid_password') {
+       *     await notifyUser(pk, adminforth.auth.getClientIp(extra.headers));
+       *   }
+       * },
+       * ```
+       */
+      afterLoginFailed?: AfterLoginFailedFunction | Array<AfterLoginFailedFunction>,
+
       /**
        * Function or functions  which will be called before user try to login.
        * Each function will resive User object as an argument
 
@@ -334,6 +334,43 @@ non-existing users, so an attacker can't use it to find out whether credentials
 
 If your check needs the user record itself (like two-factor authentication does), use [auth.beforeLoginConfirmation](/docs/api/Back/type-aliases/BeforeLoginConfirmationFunction) instead: it is called after credentials are verified.
 
+## Tracking failed login attempts
+
+`auth.afterLoginFailed` hooks are called after password login attempt failed, right before AdminForth answers with `401`:
+
+```ts title="./index.ts"
+export const admin = new AdminForth({
+
+  ...
+
+  auth: {
+    afterLoginFailed: [
+      async ({ username, pk, reason, adminforth, extra }) => {
+        if (reason === 'invalid_password') {
+          await notifyUser(pk, adminforth.auth.getClientIp(extra.headers));
+        }
+      }
+    ]
+  }
+
+  ...
+
+})
+```
+
+`reason` tells why the attempt failed:
+
+- `rejected`: one of `auth.beforeLoginAttempt` hooks rejected the attempt, credentials were not checked
+- `user_not_found`: there is no user with such username
+- `invalid_password`: user exists, but password is wrong
+
+`pk` is the primary key of the user and is `null` when reason is `rejected` or `user_not_found`.
+
+Attempts blocked by `auth.rateLimit` don't call the hook, so the number of hook calls per IP is never higher than the rate limit.
+Still, every call happens while the client waits for the response, so keep the hook cheap: for example, aggregate attempts in memory and write them to the database in batches.
+
+Hooks can't change the response: error thrown from the hook is logged and login still answers with `401`.
+
 ## Tracking created sessions
 
 `auth.afterSessionCreated` hooks are called right after auth cookie with a new session was issued. They are called for
 
@@ -0,0 +1,75 @@
+import request from 'supertest';
+import { admin, app, closeApplication } from './authTestApp';
+
+type LoginFailedHook = (params: { username: string, pk: string | null, reason: string, adminforth: any, extra: any }) => Promise<void>;
+type LoginAttemptHook = (params: { username: string, adminforth: any, extra: any, tr: any }) => Promise<{ ok: boolean, error?: string }>;
+
+const hooks = admin.config.auth.afterLoginFailed as LoginFailedHook[];
+const loginAttemptHooks = admin.config.auth.beforeLoginAttempt as LoginAttemptHook[];
+
+const login = (username: string, password: string) =>
+  request(app).post('/adminapi/v1/login').send({ username, password });
+
+afterAll(async () => {
+  await closeApplication();
+});
+
+afterEach(() => {
+  hooks.length = 0;
+  loginAttemptHooks.length = 0;
+});
+
+describe('auth.afterLoginFailed', () => {
+  it('receives reason and pk of user for every kind of failed attempt', async () => {
+    const calls: { username: string, pk: string | null, reason: string }[] = [];
+    hooks.push(async ({ username, pk, reason }) => { calls.push({ username, pk, reason }); });
+
+    await login('adminforth', 'wrong password');
+    await login('nobody@example.com', 'wrong password');
+    loginAttemptHooks.push(async () => ({ ok: false, error: 'Captcha verification failed' }));
+    await login('adminforth', 'adminforth');
+
+    expect(calls).toHaveLength(3);
+    expect(calls[0]).toEqual({ username: 'adminforth', pk: expect.anything(), reason: 'invalid_password' });
+    expect(calls[1]).toEqual({ username: 'nobody@example.com', pk: null, reason: 'user_not_found' });
+    expect(calls[2]).toEqual({ username: 'adminforth', pk: null, reason: 'rejected' });
+  });
+
+  it('receives normalized username and request data', async () => {
+    const calls: { username: string, headers: Record<string, string> }[] = [];
+    hooks.push(async ({ username, extra }) => { calls.push({ username, headers: extra.headers }); });
+
+    await request(app)
+      .post('/adminapi/v1/login')
+      .set('x-some-header', 'value')
+      .send({ username: '  ADMINFORTH  ', password: 'wrong password' });
+
+    expect(calls).toHaveLength(1);
+    expect(calls[0].username).toEqual('adminforth');
+    expect(calls[0].headers['x-some-header']).toEqual('value');
+  });
+
+  it('is not called for successful login', async () => {
+    let called = false;
+    hooks.push(async () => { called = true; });
+
+    const res = await login('adminforth', 'adminforth');
+
+    expect(res.status).toEqual(200);
+    expect(called).toBe(false);
+  });
+
+  it('keeps 401 response when hook throws and calls the next hooks', async () => {
+    let secondCalled = false;
+    hooks.push(
+      async () => { throw new Error('Log storage is down'); },
+      async () => { secondCalled = true; },
+    );
+
+    const res = await login('adminforth', 'wrong password');
+
+    expect(res.status).toEqual(401);
+    expect(res.body).toEqual({ error: 'Invalid username or password' });
+    expect(secondCalled).toBe(true);
+  });
+});