The active sessions page records each device and browser extension signed in to an AliasFleet account, with device, browser, operating system, approximate location and last active time shown for every entry. This page covers checking that record, revoking one session or all other sessions, and the action to take after an unfamiliar session is revoked.
A signed-in AliasFleet account is required. Revoke all other sessions signs out every session except the session currently in use, so the current device remains signed in.
What does each session row show?#
Each entry in the active sessions list stands for one signed-in device or extension:
| Field | What it shows |
|---|---|
| Device | Device type: desktop, mobile, or tablet |
| Browser and OS | Browser name and operating system of the signed-in device |
| Approximate location | City or region derived from the session IP address |
| Last active | Date and time the session was last used |
The session currently in use carries a separate mark in the list, so it stands out from the other entries. Location is approximate, based on IP address, so it can show a nearby city rather than an exact place.
How do I view my active sessions?#
- Open Settings: In the dashboard sidebar, select Settings.
- Open Security: Select the Security tab to open the security page.
- Find the active sessions list: Scroll to the active sessions section. Web sessions appear in this list. Extension sessions are managed separately: open the Browser Extensions section on the same page and click Manage Extensions.
- Review each row: Compare the device, browser and operating system, approximate location, and last active time with the devices actually in use.
How do I revoke a single session?#
- Open the sessions list: Go to Settings, then Security, and find the active sessions section.
- Click Revoke: Click Revoke for the session to be signed out.
- Confirm the result: Reopen the list and check that the revoked session no longer appears.
A revoked device must sign in again with username and password, plus two-factor authentication if that is enabled on the account. Revocation does not change the password, so a device that still holds the password can sign back in. A password change therefore follows any revocation made over suspected unauthorised access. These steps revoke a web session. To revoke an extension session, open the Browser Extensions section and click Manage Extensions.
How do I revoke all other sessions?#
- Open the sessions list: Go to Settings, then Security, and find the active sessions section.
- Click Revoke all other sessions: Select the option to revoke all sessions except the current one.
- Confirm if prompted: If a confirmation prompt appears, confirm the action. Every session except the current one is signed out at once.
This is the fastest option when the account may have been accessed by someone else, or when several unfamiliar sessions appear and checking each one would take too long.
How do web sessions and extension sessions differ?#
Web sessions are browser logins to the AliasFleet website. Extension sessions are separate logins for the browser extension, and they are managed from the Browser Extensions section through the Manage Extensions dialog. Revoking a web session does not revoke an extension session, and revoking an extension session does not affect web logins. Each list is managed independently, so both lists need checking during a review of account access. The browser extension guide explains how extension sessions work.
How do I confirm a session was revoked?#
Reopen the active sessions list from Settings, then Security. A revoked session no longer appears in the list. The current session remains listed and marked as current. If a revoked session still appears, refresh the page and check again before taking further action.
What do I do if a session looks unfamiliar?#
An unfamiliar session is one from a device not owned by the account holder, a location that does not match any recent travel or VPN use, or a last active time when the account was not in use. Take these steps in order:
- Revoke the session: Revoke the unfamiliar session, or use Revoke all other sessions if it is unclear which entries are legitimate.
- Change the password: Change the account password immediately after revoking. Revoking alone signs the device out, but the old password still works for a fresh sign-in. See Changing Your Password.
- Check two-factor authentication: Confirm two-factor authentication is enabled, and enable it if it is not. Two-factor authentication blocks sign-in attempts that use only the password. See Two-Factor Authentication.
- Re-check the list: Reopen the active sessions list after changing the password and confirm no unfamiliar session has returned.
A password change alone does not close an active session, and revoking alone does not stop a fresh sign-in with a known password. The two steps together close both gaps. Changing Your Password Does Not Always Stop a Hacker explains why live sessions survive a password change on many services.
Why does a known device show an unfamiliar location?#
Approximate location comes from the session IP address. A VPN, a corporate network, or a mobile network can route traffic through a different city, so a known device can appear in an unexpected location. Check the device type, browser, and last active time as well. If those match a device in use, the location alone is not proof of unauthorised access. If the device itself is unrecognised, revoke it and follow the steps above.
Why is an extension session still listed after revoking web sessions?#
Extension sessions are separate from web sessions. Revoking web sessions leaves extension sessions untouched. Open the Browser Extensions section on the security page, click Manage Extensions, and revoke the extension session from that dialog. For general account security habits, see Security Best Practices.