This page covers AliasFleet browser extension sessions: what a connected extension session is, what access it holds, and how to end it. After following the steps, every connected extension session will have been checked, any unwanted session revoked, and only intended extension instances left connected.
A browser extension session exists only after the AliasFleet browser extension signs in on a browser profile or device. Reviewing and revoking sessions requires access to the AliasFleet account through the web dashboard. No separate permission or plan is stated for session management on this page.
What is a browser extension session?#
A browser extension session begins when the AliasFleet browser extension signs in on a browser profile or device. The session lets the extension operate without an active web login. Every browser profile or device with a signed-in extension holds its own session, and every session appears as a separate entry for review and revocation.
Which page covers extension setup instead of extension sessions?#
Extension sessions are the only subject of this page: viewing them, checking their access, and revoking them as a security task. Installation, sign in, alias creation inside signup forms, and autofill belong to Using the Browser Extension. That page covers setup and day to day use. The sessions that sign-in creates are covered here.
What can the browser extension access?#
The extension's access is fixed to two functions: creating aliases and reading the alias list. The table lists the full scope described for extension sessions.
| Access | Status |
|---|---|
| Create new aliases | Yes |
| Read the alias list, for autofill and management | Yes |
| Access payment details | No |
| Change the password or modify account settings | No |
| Read the content of emails forwarded through aliases | No |
Revocation deletes nothing. Aliases, destinations, and account data stay unchanged after a session is revoked. The disconnected extension instance only needs to sign in again before further use.
How do I view connected extension sessions?#
- Open Settings Security: In the web dashboard, go to Settings, then Security.
- Find the Browser Extensions section: The section states how many extension sessions are active.
- Open the session list: Click Manage Extensions to display each session.
- Read each entry: Each session shows device type and browser, approximate location based on IP, and last active time. Compare each entry against the browsers and devices still in use.
How do I revoke one extension session?#
- Open the session list: Go to Settings Security, find the Browser Extensions section, and click Manage Extensions.
- Find the session: Identify the entry by device type, browser, approximate location, and last active time.
- Click Revoke: Click Revoke next to that session. The extension instance disconnects immediately and must sign in again before further use.
How do I revoke all extension sessions?#
- Open the session list: Go to Settings Security, find the Browser Extensions section, and click Manage Extensions.
- Click Revoke All: Click Revoke All at the bottom of the dialog. Every extension instance disconnects at once and each must sign in again before further use.
- Confirm the list is empty: Reopen the Browser Extensions section and check that no active extension session remains.
Revoke All fits three situations: after a password change, after losing a device, or when starting fresh with only browsers currently in use signed in.
How do I confirm a session is revoked?#
After revoking one session, reopen Manage Extensions from the Browser Extensions section and check that the entry is absent from the list. After Revoke All, check that the section shows no active extension session. On the disconnected browser, the extension also requires sign in again before alias creation or autofill works, which confirms the disconnect from that end.
What should I do about a session I do not recognise?#
Revoke the session at once, using the single session Revoke action. An unfamiliar location, an unfamiliar browser, or a device no longer owned are all grounds for revocation. After revoking, check web sessions as well, because extension sessions and web sessions are managed independently. Active Sessions covers viewing and revoking web logins. If the account password may also be known to someone else, changing the password is the next step. See Changing Your Password.
Why is the extension still connected after web sessions were revoked?#
Extension sessions and web sessions are tracked separately by design. Revoking web sessions ends web logins only, and the browser extension stays connected. The reverse also applies: revoking extension sessions leaves web logins connected. Locking down an account fully requires revoking both types independently, from the Browser Extensions section for extension sessions and from the active sessions list for web sessions.
What should I do after losing a device?#
Use Revoke All in the Browser Extensions section to disconnect every extension instance, including the lost device. Then revoke web sessions from the active sessions list as well, since the lost device may also hold a web login. After both revocations, change the account password, since the lost device may still hold it. See Changing Your Password. After both revocations and the password change, sign in again only on browsers and devices still in use. The lost device then requires the account credentials before the extension can be used again.
Related reading: Active Sessions for web login sessions, Using the Browser Extension for extension setup and use, and An Email Alias Is Only as Safe as the Provider Behind It for the security reasoning behind limiting what an alias tool can access.