What an active session actually is, and why a password alone won't fix it
After you sign in, a service doesn't keep re-checking your password — it issues your device a session token or cookie, and that token is what authenticates every request until you sign out or the session expires on its own. The ‘devices’ or ‘active sessions’ list in account settings is a list of those issued tokens, not a list of passwords or physical gadgets.
That's the part people miss: changing your password doesn't automatically kill sessions that are already open on some services. A token issued earlier keeps working until you explicitly hit ‘Sign out’ on that device or ‘Sign out everywhere.’ If someone got in by stealing a live session instead of guessing your password, changing the password alone won't remove them.
This is exactly how session hijacking bypasses two-factor authentication: the 2FA code was already entered at the moment of the original, legitimate login, and the stolen token simply proves that check already passed. For how malware actually steals sessions and cookies off a device, see our piece on infostealer malware — we won't repeat that mechanics here, just show you how to spot its traces in your session list and kick the hijacked session out.
In 2026, some Windows users running Chrome 146 got an extra layer of protection: a technology called DBSC (Device Bound Session Credentials) binds a session to a cryptographic key stored in the device's hardware module — the TPM. Even if a cookie is stolen and copied to another machine, it won't work without that same physical module. Support is currently Windows-only, with macOS promised later.
How to check where you're signed in to your Google Account
Path: myaccount.google.com → ‘Security’ → ‘Your devices.’ That shows every device currently signed in, and a ‘Manage all devices’ link opens details for each: device model, approximate location, and last activity time.
Two things trip people up here. First, the time shown is the last moment the device exchanged data with the server, not necessarily the last time you opened the app by hand — background mail or calendar sync can ‘refresh’ the entry long after you actually used the device. Second, location is only approximate, based on IP address, and can point to a nearby city, an airport, or a hotel instead of your exact spot — that's a quirk of IP geolocation, not an account error.
If one entry belongs to a device you don't recognize, open it and choose ‘Sign out.’ There's also a separate option to end every session on every device at once — worth using if you're not confident narrowing it down to just one entry.
A brand-new device, a recent factory reset, or signing in from a shared computer (library, co-working space) can also produce an entry that looks unfamiliar at first glance even though nothing was actually hacked.
Microsoft, Apple ID and Facebook: where to find login history
Microsoft account
At account.microsoft.com, the security section shows recent sign-in activity along with an option to sign out of all sessions at once. The entries list device type, approximate location, and time — the same basic shape as Google's device list.
Apple ID
Apple ID also keeps a list of devices signed in with your Apple ID, available from your account settings. It's worth a glance the same way you'd check any other account, though — worth noting — LiMP VPN itself doesn't ship an iPhone or Mac app, so this section is purely about reviewing the list, not about where to run a VPN on that device.
Facebook and Instagram
Inside Accounts Center, under ‘Password and security,’ there's a ‘Where you're logged in’ section listing active sessions across both apps with device and approximate location, plus a button to log out of sessions you don't recognize.
Messaging apps: Telegram active sessions and WhatsApp linked devices
In Telegram, open Settings → Devices (in some app versions it's under ‘Privacy,’ as ‘Active Sessions’). Each entry shows the app, version, and an approximate connection location, and ‘Terminate all other sessions’ signs out everywhere except your current device. Inactive sessions have a built-in safety net: Telegram automatically ends a session that hasn't been used in a long time — 18 months by default, adjustable in settings. For the specific tricks attackers use to hijack a Telegram account in the first place, see protecting your Telegram account from hijacking — we won't repeat that here, this section is only about using the session list as a diagnostic.
WhatsApp's equivalent is called ‘Linked Devices’ — it lists computers and web sessions tied to your account through your phone. If you see a browser or computer you don't remember opening WhatsApp Web on, you can unlink it with one tap without touching your phone or your main account.
Telling a stranger's login apart from your own: VPN, mobile carriers, and new devices
The most common false alarm isn't a hack at all — it's ordinary network behavior. The table below helps you quickly match what you see in a login list to a likely cause and what to do about it.
| What you see in the list | Likely cause | What to do |
|---|---|---|
| A VPN server's city or country | The service is showing the VPN server's location, not your real one | Compare it to the server country selected in your VPN app — nothing to worry about |
| A different city on mobile data | Mobile carrier IP addresses are tied to a region, not your exact physical point | Normal cellular network behavior, no action needed |
| An ‘unknown Windows device’ after a reinstall | A fresh OS install or factory reset makes the device look brand-new to the service | If it's your device, confirm it and rename the entry for clarity |
| An old phone you sold or gave away | A session on an old device can stay active even after you stop using it | End that specific device's session separately |
| A browser session on someone else's computer | You forgot to sign out after using a hotel, co-working, or work PC | End the session remotely, and use incognito mode or an explicit sign-out next time |
| A nighttime login from another country with VPN off | A genuine warning sign — neither your device nor a VPN explains this connection | Move straight to the response steps in the next section |
| A new device plus changed recovery options | Almost certainly an account takeover, not a coincidence | Change your password immediately and audit every recovery setting |
If you use a VPN, keep the server country you've selected in the app in mind — then an entry in your login history stops being a mystery. The full list of LiMP VPN server locations is on the servers page.
Found a stranger's session: what to do, calmly and in order
Order matters here: if you just kick the intruder out without changing your password first, they can sign right back in the same way they got in the first time. That's why the password comes first, and ending sessions comes second.
- Change your password from a trusted deviceThat blocks the attacker from signing back in with the old password, even before you've found and closed their session.
- End every other sessionNow that the password is already changed, it's safe to sign out of every active session except your own — the old password those sessions were opened with no longer works.
- Check your recovery email, phone number, and backup codesAttackers often swap these first to lock in access and block you from recovering the account the normal way.
- Check your two-factor setupMake sure no unfamiliar authenticator app or physical security key has been added to the trusted list.
- Check mail forwarding rules and connected appsA rule that quietly copies incoming mail to another address, or a forgotten OAuth permission for a third-party app, is a common way to keep reading your data after the password's already been changed.
- Check the device itself for malwareIf the hijack happened through a cookie stolen off your own computer or phone, changing the password doesn't remove the actual cause — for warning signs of a compromised device, see protecting your account from hacking.
How to avoid getting your session hijacked again
Two-factor authentication through a dedicated authenticator app or a passkey is stronger than an SMS code — SMS codes can be intercepted through SIM swapping, a scheme covered in detail in our SIM swap attack article. Switching to passwordless sign-in with a passkey removes the possibility of password theft entirely — see how that works in our passkeys piece.
A simple rule for other people's computers: don't save your login, and actually click ‘Sign out’ instead of just closing the browser tab. Skip browser extensions from questionable sources altogether — some of them can read cookies from your open tabs, which is another session-hijacking channel that has nothing to do with your password or your phone number.
On open networks — cafés, airports, hotels — turning on a VPN is worth doing; see public Wi-Fi security for the risks and how a VPN helps there. Worth being honest about the limits here: a VPN encrypts your connection and protects against traffic interception on that network, but it won't neutralize a cookie that's already been stolen directly off your device by malware — those are two different threats handled by two different layers of protection. If you want a VPN running every day rather than just on trips, see LiMP VPN pricing.
Monthly account checklist: 10 minutes
- Open your Google Account device list and review it
- Check Microsoft account sign-in activity
- Check Telegram active sessions and WhatsApp linked devices
- Check Facebook/Instagram login activity and any other social accounts you use
- Glance at the security section of your bank and other sensitive apps
- Check for mail forwarding rules you didn't set up
- Remove app access you granted long ago and no longer use
- Note the date so you remember to repeat this in a month
