Sessions

See every place you are signed in, end one session or all of them, and understand when a session ends by itself.

On this page

A session is the record that one browser or app is signed in to your account right now. Each time you sign in, a new session starts. The Sessions tab of Devices lists all of them, so you can spot one you do not recognise and end it.

The sessions table#

The Sessions page: a table of four signed-in sessions with device, location, IP address, when each started and was last active, when it expires and how it signed in. The first row is marked as this session. — Sessions: every browser or app that is signed in now. Addresses are from the documentation range. Sample data./account/sessions

The table is titled Signed-in sessions. The session you are using is always first, and the rest are ordered by when they were last active. Each row has these columns:

Column	What it shows
Device	The browser and system the session runs on, for example a browser name and an operating system. It reads Unknown when the platform could not tell.
Location	An approximate city and country worked out from the network address. It is blank when that could not be determined.
IP address	The address the session was started from.
Signed in	When the session started.
Last active	When the session last made a request.
Idle timeout	When the session ends if nothing uses it. Activity moves it forward.
Expires	The latest moment the session can last, whatever you do.
Sign-in method	How you proved who you were, for example Passkey, Password, Authenticator app, Recovery code, Email link or Linked account. A session can list more than one. A method the page has no word for is shown as the code the server sent.
Assurance	How strong the sign-in was: One factor, Two factors or Strongest. A sign-in with a password alone is One factor; so is one finished with an emailed code in place of a lost passkey.
Signed in to	The applications this session signed in to, by name, if any.
Device status	Recognised device when the browser is one your account knows. Blank when it is not.
Company sign-in	For a session that came through your organization's single sign-on connection: the connection and the organizations it covers, each marked (two factors) where the identity provider said it used a second factor, for example a connection name for an organization. Blank for any other session.

Times are shown in your time zone. The location is approximate and is not a precise place.

Sign out of one session#

Open Devices. The Sessions tab is the first one.
Find the row you do not recognise or no longer use.
Select Sign out on that row.
In the dialog Sign out of this session?, confirm with Sign out.

The dialog says that the browser using that session is signed out, and that apps that session signed in to lose access.

You cannot end the session you are using from its own row. It shows Current instead of a button. To end it, use Sign out in the account menu at the foot of the navigation.

You may be asked to confirm with a second factor before a session is ended. A session opened with the lost-passkey email code always is: see After a lost-passkey sign-in. If so, a dialog titled Confirm it is you opens. See Confirming it is you below.

Sign out everywhere#

Sign out everywhere ends every session on your account, including the one you are using. Its dialog is titled Sign out of every session? and says that you will sign in again. After you confirm, you are taken to the sign-in page.

The button appears only when at least one other session exists. When this browser holds your only session, there is nothing else to end and the button is not shown.

Use it when a device is lost or stolen, when you used a shared computer and are not sure you signed out, or when you think someone else has used your account.

Changing your password, removing a passkey, turning off the authenticator app or unlinking a linked account also signs your other devices out and keeps the one you are using. See Security and passkeys.

When a session ends on its own#

A session ends without you doing anything in these cases.

Idle. After 12 hours with no activity, unless the organization the session was created for sets its own limit.
Absolute. 14 days after you signed in, even if you were active throughout, unless that organization sets its own limit. This is the time shown in Expires.
Too many sessions. If an organization caps how many sessions a person can have, signing in again can end your oldest one.
You switched organization. Choosing another organization in the switcher at the top of the account opens a new session there and ends the one you left, unless an application you are signed in to still depends on it. See Changing organization.
A security change. Changing your password, removing a passkey, turning off the authenticator app or unlinking a linked account ends your other sessions and keeps the one you used.

The defaults are also stated on Security practices. See Session lifetimes for what an organization can change and Sessions and tokens for how sessions work. When a session ends, the next request from that browser sends you to the sign-in page.

Live status#

An open account page checks that its own session still exists when you switch back to the tab and when you use the page, never on a timer. If you ended that session from another browser, or used Sign out everywhere there, the page you left open sends you to the sign-in page the next time it checks, which is when you come back to it or next click or type in it. The check does not extend the session: leaving a tab open does not keep you signed in.

A network error or a server error never signs you out. Only the platform's answer that the session no longer exists does.

Confirming it is you#

Some actions on your account ask for a second factor you used in the last 30 minutes. When that is needed, a dialog titled Confirm it is you opens. It offers Use a passkey, or the 6 digit Authenticator code from your authenticator app with a Confirm button. On a session you opened with a passkey, Other ways to confirm also offers your Account password. After you confirm, the action you started is repeated automatically.

If your account has no second factor, the dialog says so and links to Open Security, where you can set one up. See Security and passkeys.

What can go wrong#

What you see	What it means
A row you do not recognise	Someone may have your password or a session cookie. End the row, then change your password and review Security and passkeys.
You are sent to the sign-in page unexpectedly	The session ended: it idled out, hit its absolute limit, a security change ended it, or you or another browser ended it. Sign in again.
The dialog Confirm it is you appears	The action needs a second factor from the last 30 minutes. Confirm and it continues.
Sign out everywhere is missing	You have no other session to end.

If you lost your only passkey, the sign-in can say "Lost your passkey? We can email an 8-digit code to the address you are signing in with instead." and offer Email me a code instead. The sign-in page warns that this sign-in is one level lower than a passkey, and that some apps will still ask for your passkey. A session opened that way is one level lower than a passkey session: it lists One factor under Assurance, and its Sign-in method column shows Password and Email code. It never counts as having used a second factor.

On that session, Sign out on another session and Sign out everywhere open the Confirm it is you dialog, and ask for a passkey or authenticator code you used in the last 30 minutes. Signing out of the session you are using is not affected. The same session also asks for that second factor before you leave an organization, accept or decline an invitation, add an email address, cancel a recovery, revoke an application's access or mark security events read. If you have no second factor to give, those actions stay unavailable on that session. The rule applies only to accounts that hold a passkey or an authenticator app.