Every device you sign in from creates a session. Your profile lists them, and you can end any one you do not recognise.
Review your sessions
- Open the user menu and choose Account Settings, then Two-factor & sessions.
- Find the Active sessions panel.
Each entry shows the browser and device it was created from, and when. Your IP address is stored only as a hash, so the list identifies sessions without keeping a record of where you have been.
End a session
Choose Revoke on its row and confirm. That device is signed out immediately and has to sign in again.
The session you are using is marked This device and has no Revoke button. Sign out to end that one.
Revoke a session whenever you no longer recognise it, you have signed in on a device you no longer have, or you suspect someone else has your password. In the last case, change your password as well, since a session ending does not stop someone signing in again.
Trusted devices
If you use two-factor authentication, a device can be remembered so it does not ask for a code every time. A device is added to that list when you tick Remember this device for 30 days at the two-factor prompt, and the entry expires on its own after 30 days.
Remembered devices appear in the Trusted devices panel on the same screen, and you can revoke one there.
Revoking a session does not remove the device's trust. That browser will still skip the two-factor prompt the next time it signs in, so a password alone gets it back in. To close that off, revoke the device in Trusted devices as well: revoking a trusted device also signs out the sessions created from it.
Sessions expire on their own
A session lasts 3 days from when you signed in. After that it disappears from this list and that device has to sign in again. There is no sliding renewal, so staying active does not extend it.
Revoking is for ending one early.