Tell People How Long Signing Out Everywhere Takes

Security & Access · authentication, security, microcopy

Updated 2026-08-04

Know whether your sign-out is immediate. Many products issue a signed token such as a JWT that stays valid until it expires, so signing out ends it on this device while other sessions can keep working for minutes.
Say so plainly when it is not instant. "Other devices will be signed out within 15 minutes." is a fact someone can act on, and silence lets them believe a stolen laptop was locked out at once.
Give the panic path a stronger guarantee than the ordinary one. The control someone reaches for after a theft has to actually cut access now, even if that costs more on every request.
Cover every route back in rather than only the obvious one:

Force re-authentication after a password change, and say that it happened. A password change that leaves an attacker's session alive is the most damaging false sense of safety in a product.
List active sessions with device, location, and last used, and let each be ended individually. It is what turns an abstract worry into a specific action.
Confirm the result rather than the request. Signed out of 4 other sessions is verifiable, and Done is not.
Notify by email when sessions are ended. If the user did not do it, that message is how they find out.

Sign-out is a security promise, and a promise with a delay in it has to state the delay.