Sessions and signing out
How long you stay signed in, how many devices you can use at once, what signing out does, and how to sign out a device you've lost.
On this page
Signing out
Open your account menu and choose Sign out. This ends your session on our servers, clears your decryption key from the browser, signs out your other open PIToolkit tabs in that browser, and takes you to the sign-in page. Going back in your browser history won’t show anything you had open.
How long a session lasts
A session ends automatically after:
- 24 hours without activity, or
- 7 days in total, even if you’re using it,
whichever comes first. Then you sign in again.
How many devices at once
You can be signed in on up to 5 devices or browsers at the same time. If you sign in on a sixth, your oldest session is signed out, and the new sign-in tells you so. If that wasn’t you, change your password.
Seeing your sessions
In Settings, section Account & security:
- Active sessions shows how many devices are signed in.
- Last sign-in shows when you last signed in, followed by “Location not recorded”. PIToolkit doesn’t work out where a sign-in came from. Our servers do keep each session’s IP address and a description of the browser, which aren’t shown here; see What PIToolkit can and cannot see.
There isn’t a list of individual devices yet, and you can’t sign out one device on its own.
If a device is lost or stolen, or you see a session you don’t recognise
Change your password from Settings, Account & security, Password. That immediately signs out every other device. If you think your password or recovery key was exposed, also use Generate a new recovery key, and consider Replace my account key. Replacing your account key signs out your other devices too; generating a new recovery key doesn’t sign anyone out. See Your recovery kit.
Turning on two-factor authentication also signs out every other device, so it’s worth doing now if it’s off.
New-device alerts
When your account is signed in from a device or network PIToolkit hasn’t seen before, you get an email, “New sign-in to your PIToolkit workspace”, and a notification, “New sign-in from a device we do not recognise”. The email doesn’t say which device, browser or place it was: if it wasn’t you, change your password and review your security settings. This alert, and other security alerts, can’t be switched off.
To spot a new device, PIToolkit keeps a scrambled fingerprint of your account, browser and network, made with a secret key held on our servers, so the fingerprint alone doesn’t reveal those details. Occasionally a device you’ve used before triggers the alert once more, for example after that key is changed on our side. See Notifications and preferences.