You can have a strong password and two-factor authentication and still get your account taken over — if an attacker steals your session instead of your password. Session hijacking is one of the most important attacks to understand today, because it sidesteps the very defenses most people rely on. Our GetMyPassword team explains what session hijacking is and how to protect yourself.
What a session is
When you log in, the site does not ask for your password on every click. Instead it hands your browser a session token — a cookie that says “this person is already signed in.” That token is what keeps you logged in as you browse. It is convenient, and it is also the prize an attacker really wants.
How hijacking works
In session hijacking, an attacker steals that token and loads it into their own browser, becoming you — without ever knowing your password. Worse, because you already passed your two-factor check when the session began, a stolen session can bypass 2FA entirely. That is what makes it so dangerous: the usual locks are already open.
How tokens get stolen
- Infostealer malware — today’s biggest source, scooping cookies straight off an infected device.
- Malicious browser extensions that can read your cookies and data.
- Unsecured connections on sites that do not use HTTPS, letting tokens be sniffed.
- Cross-site scripting on vulnerable websites that leaks your session.
A stolen session is a skeleton key that skips the password and the 2FA prompt alike. That is why keeping malware off your device matters as much as any password you choose.
How to protect yourself
Because session hijacking targets your device, device hygiene is the front line. Keep malware off your computer: only install software and extensions from trusted sources, keep everything updated, and run reputable security tools. Make sure sites use HTTPS, and log out of important accounts on shared computers to end the session. Strong unique passwords from our password generator and 2FA still matter for everything else — but against this attack, a clean device is your best defense.
Frequently asked questions
What is session hijacking?
It is an attack where someone steals your active session token — the cookie that keeps you logged in — and uses it to access your account as you, without needing your password and sometimes bypassing two-factor authentication.
Can session hijacking bypass two-factor authentication?
Yes. Because you already passed the 2FA check when the session started, a stolen session token can let an attacker in without facing the password or 2FA prompt again. This is what makes it so dangerous.
How do I prevent session hijacking?
Keep malware off your device by installing only trusted software and extensions and staying updated, use sites over HTTPS, run security software, and log out of important accounts on shared computers to end the session.