Trusted devices
How identity recognises a browser, what the labels Trusted, Recognised and Not trusted mean, and what trusting a device does and does not do.
On this page
A device here means a browser that your account has signed in from. Identity keeps a short list of them so it can tell a browser you use every day from one it has never seen. The list is shown under Devices in your account, on the Trusted devices tab.
How a browser is recognised#
When a sign-in completes, identity gives the browser a random value in a cookie, __Host-device_id, and records a device for your account against it. The value is not personal data and it is not shared with anything else. Next time, the cookie is how identity knows that browser. It lasts up to 400 days, and the account stores only a hash of it. See Cookies.
This means a device is a browser profile, not a physical machine. A second browser on the same laptop is a second device. Clearing cookies, using a private window, or switching browsers makes a browser look new, and the next sign-in from it is treated as a new device.
The three labels#
| Label | Meaning |
|---|---|
| Trusted | You marked this browser as trusted. |
| Recognised | The account has seen this browser from a sign-in. You have not marked it either way. |
| Not trusted | You untrusted this browser or used Untrust all devices, or every sign-in from it so far was a limited, password-only one (a new browser admitted with the password alone). A sign-in that proves more than the password makes it Recognised: a second factor, or a link or code emailed to you. |
A device is Recognised automatically after a first sign-in that proved more than the password. A browser that has only ever signed in with the password stays Not trusted, however often it signs in, and each of those sign-ins sends the alert email. Trusted is something only you can set.
What trusting a device does#
Trust is a statement to identity that you control this browser. Two things follow from it by default, and a third where your organization allows it.
- It is not treated as new. The unfamiliar browser check looks at whether a browser is known. A Trusted or Recognised device is known. See The unfamiliar browser check.
- A known browser raises no new-device alert. A first sign-in from a browser the account has not seen before can send you a new-sign-in alert. A browser the account already knows does not, with one exception: a sign-in with the lost-passkey emailed code always sends the alert, even from a known browser, and never offers to remember the browser. See Authentication methods.
- It may skip a step, where your organization allows it. An organization can let a trusted device skip the authenticator code after a password. This is available where your organization allows it, and is not on by default. Without it, trusting a device changes no step of your sign-in.
Trusting a device never skips a passkey check. See Assurance levels for what the levels mean.
What it takes to trust one#
Marking a device as trusted is a sensitive change. It asks for a step-up and sends you a security alert by email. See Step-up.
You can trust at most ten devices at a time. When you trust an eleventh, the device you trusted longest ago drops back to Recognised, and the one you just trusted stays.
When trust is taken away#
Identity lowers trust on its own in these cases, so a device trusted under old credentials cannot carry that trust into new ones.
| Event | What happens to trust |
|---|---|
| You change a credential: password, passkey or authenticator app | Trusted devices drop to Recognised. |
| You finish account recovery | Trusted devices drop to Recognised. |
| You choose No, sign that session out on a sign-in alert | That device is forgotten, and every other device drops from Trusted to Recognised. |
| You choose No, secure my account | Devices are forgotten. |
| You select Untrust all devices | Every Trusted or Recognised device becomes Not trusted. |
Remove forgets a device altogether: signing in from it again makes it a new device.
A new browser is held back from changing how you sign in#
Where it applies, a password-only sign-in from a browser the account has only just met cannot immediately add or change a sign-in method. The account area says that a sign-in method can be added from a browser your account has known for 24 hours. A sign-in that used a passkey or a second factor is not held back by this. For a password-only account adding its first passkey or authenticator app, the password has to be that old too, so a password set a moment ago at registration or at a Choose a password step does not count yet. A sign-in finished with the emailed code that replaces a lost passkey is held to the stronger rule: it can change a sign-in method only after a second factor is confirmed. The reason is plain. If someone steals only your password, they can sign in, but they cannot use that new, unknown browser to add their own passkey and lock you out. The first sign-in from a new browser can also send you an alert, so you have a day to react.
The 24 hours is the default and the minimum: an operator can lengthen the wait, up to 30 days.
If you are on a genuinely new device and need to add a method, use a browser the account already knows, or sign in on the new one once with a link or code emailed to you and wait a day. A browser becomes known only through a sign-in that proved more than the password (a passkey, an authenticator code, or a link or code emailed to you); a password alone never does, however long it is used. A browser created by a password-only sign-in stays untrusted until a sign-in that proved more than the password, or the "Confirm it is you" step with your passkey or authenticator app, makes it known.
Managing devices#
On the Trusted devices tab you can Rename a device (up to 100 characters), Trust or Untrust it, Remove it, or use Untrust all devices at the top right. The steps and screenshots are on Sessions and devices.