The security feed

Where security events on your account appear, what the badges mean, how to open an event and how to mark events read.

On this page

The Inbox tab of Notifications is a list of security events on your account, newest first. It is where a passkey you added, a password you set or an email address you added shows up, so you can spot a change you did not make. Open an event to go to the page it is about.

The Notifications inbox listing three unread security events: a passkey added, a password set that is flagged to review, and an email address added. — Notifications: security events on the account, newest first. Sample data./account/notifications

Read your notifications#

Select Notifications in the account navigation, or the bell in the top bar. The bell opens a short list of the latest events, with See all to reach the full page.
Look for events with a marker. An unread event carries a dot. A screen reader announces it as New.
Look for badges. An event that deserves a second look has a badge, Review or Review now. Routine events have none.
Select an event to open the account page it concerns.
Select Mark all as read to clear the markers. Load older events shows earlier ones.

Each event shows a plain-language label in the language of the page, such as Passkey added in English, when it happened, and the network address it came from when there is one.

Where an event takes you#

Kind of event	Opens
Access tokens	Access tokens
Email addresses and profile changes	Profile
Devices and sessions	Sessions
Passwords, passkeys, authenticator app, recovery codes, sign-in and recovery	Security
Data export	Export your data
An app you allowed	Connected apps
Anything else	The notification list itself

What the badges mean#

Badge	Meaning	Examples
none (Routine)	Normal activity.	A passkey added, an authenticator app set up, an email address added, a linked account connected, an access token created, an app allowed, a data export requested.
Review	You may want to look.	A failed password, passkey or authenticator attempt, a recovery code used, a password set or changed, a primary email change, an email removed, a linked account removed, a rejected access token, an export downloaded.
Review now	Act now if you did not do it.	A password removed, a passkey removed, an authenticator app reset, an account recovery started or completed, accounts merged, a password found in a known data breach.

The list is not every event on your account. It is a chosen set of security events. For everything, including sign-ins and sign-outs, see Activity.

How long events stay and how they load#

The feed shows the last 90 days. The first page holds the newest events and Load older events fetches the next ones. If loading fails the page says Could not load older events. Try again.

An empty feed says No events yet and that security events appear here as they happen.

Marking events read#

Mark all as read marks everything up to the newest event as read. It appears only while at least one event is unread. Marking is remembered for your account, not for one browser, and it only moves forward: older events you already read stay read.

The same Mark all as read is in the bell's panel.

The bell#

The bell in the top bar shows the number of unread events as a badge. If the newest page of events is all unread and there are older events behind it, the number may be shown with a plus sign, meaning there are at least that many. The bell lists up to six of the newest events, each opening the page it is about, and an empty bell says No notifications yet.

If you see an event you did not cause#

Treat it as a sign that someone else may have access.

Open the event to see the page it is about.
End sessions you do not recognise under Sessions.
Review how you sign in, and change your password or remove a passkey you did not add.
If a token or an app is involved, revoke it from Access tokens or Connected apps.

Many of these changes are also emailed to your verified addresses at the time. See Sign-in alert emails.