You log in once, and for the rest of the day the site just knows it is you — no password needed on every click. The thing quietly making that happen is a session token, and it is also why “log out of all devices” and “stay signed in” exist. Our GetMyPassword team explains what a session token is and why it matters for your security.
What a session token is
A session token is a temporary credential a site gives your device after you log in, so it can recognize you on each later request without asking for your password again. Think of it like a wristband at an event: you show your ticket once at the door, get the band, and after that the band alone proves you are allowed in. The token is usually stored in your browser and sent automatically with every page you load.
Why sites use them
Without session tokens, you would have to re-enter your password on every single action — exhausting and far less safe, since you would type your password constantly. The token lets the site keep you logged in for a while, remember your cart, and apply your settings. It also gives the site a clean way to end your session: logging out, or hitting “sign out everywhere,” simply invalidates the token so it no longer works.
The security catch
Because the token is your proof of identity, anyone who steals it can act as you without ever knowing your password — an attack called session hijacking. That is why tokens are protected in several ways: sent only over HTTPS, given an expiry so they do not live forever, and invalidated when you log out. It is also why a stolen token from a public computer you forgot to sign out of can be dangerous.
A session token is a key the site hands you so you do not retype your password all day. The flip side: whoever holds that key is treated as you — so logging out and expiry really matter.
How to protect your sessions
- Log out on shared or public computers so the token is invalidated, not left active.
- Use “sign out of all devices” after a scare or a lost phone to kill every active token.
- Prefer HTTPS and avoid sensitive logins on untrusted Wi-Fi, where tokens are easier to capture.
- Keep your account locked down with a unique password and two-factor authentication.
Tokens handle the convenience, but your account still rests on the password behind that first login. Give each account a unique password from our password generator and turn on two-factor authentication, so even if a session is ended or compromised, getting back in is something only you can do.
Frequently asked questions
What is a session token?
It is a temporary credential a site gives your device after login, so it recognizes you on later requests without asking for your password again. It is usually stored in your browser and sent automatically with each request.
Can someone hijack my session token?
If a token is stolen, an attacker can act as you without your password — known as session hijacking. Sites limit this with HTTPS, token expiry and logout, and you reduce risk by signing out on shared devices and avoiding untrusted Wi-Fi.
Does logging out actually do anything?
Yes. Logging out invalidates the session token so it can no longer be used, and “sign out of all devices” kills every active token at once — useful after losing a device or suspecting a compromise.