Active sessions
Review every device signed in to your account, log out sessions you don't recognize, and understand how account sessions differ from vault sessions.
The Active sessions page lists every sign-in to your account so you can spot — and end — anything you don't recognize. PulsVault distinguishes two kinds of session, matching the two-gate model.
Account sessions vs vault sessions#
| Account session | Vault session | |
|---|---|---|
| Proves | Who you are (signed in) | That you can decrypt (unlocked) |
| Created by | Signing in with password (+ 2FA) | Unlocking with Access Key (+ password) or trusted device |
| Grants | Navigation, profile, settings, seeing vaults exist | Reading and editing vault contents |
| Ends | Sign out, revocation, expiry | Auto-lock timeout, manual lock, sign out |
A valid account session without a vault session can't read any vault data — the server refuses vault requests until you unlock. Vault sessions are also bound to your device and IP address, so a stolen token doesn't work anywhere else.
Review your account sessions#
Open Account → Active Sessions. Each row shows:
- Browser & Device — browser, platform, and whether it's mobile or desktop.
- Location & IP — approximate location, IP address, and country.
- Activity Status — active or inactive, when it started, and the last activity time.
Your current session carries a green Current Session badge.
Log out a session#
- Find the session you want to end — check its location, IP, and last activity.
- Choose Log Out on that row.
- Confirm. That device is signed out and must authenticate again from scratch.
Log the session out immediately, then change your master password and review recent activity and your devices.
Vault session duration and auto-lock#
When you unlock, you choose how long the vault session lasts — from a few minutes up to 24 hours, or until you sign out. When it expires, vaults auto-lock: decryption keys are wiped from the browser — in every open tab — and everything shows as locked again. Decryption keys are only ever held in memory, so reloading the page locks the vault as well. Re-unlocking needs your Access Key together with your password, or a trusted-device approval — an authenticator code never unlocks a vault.
You can also lock manually at any time from the vault screen; locking ends the vault session on that device immediately — in every open tab — while your account session stays signed in. Signing out ends both.
Sessions are not devices#
Revoking a session signs that sign-in out. It does not remove a device's ability to unlock your vault — that is device trust, and it is revoked separately on Devices. The two surfaces sit next to each other under Account because they answer the same question from opposite ends: who is signed in, and what can decrypt.
Your current session is never offered a Log Out control — ending it would sign you out of the page you are standing on.
Related#
- Devices — devices that can unlock without the Access Key
- Activity & audit log — the full event trail
- Vaults overview — vault settings