Active sessions — Settings → Security lists every device where your account is signed in (device type, browser, last activity). Each device also shows how it signed in: Password, E-mail code or E-mail link. Sign out any device remotely — do this immediately if a laptop is lost or a shared computer was used. Changing or resetting your password signs out all devices at once; setting a first password signs out all your other devices.
Two automatic protections, tuned separately:
- Vault auto-lock — after inactivity this browser is signed out, which clears your vault from its memory; choose 1, 2, 6, 12 or 24 hours (default 24) in Settings → Security. Your other devices and sessions are unaffected.
- Sign-in duration — a signed-in session lasts up to 30 days of inactivity, then asks you to sign in again.
Failed attempts are throttled — five wrong password tries lock password sign-in for 15 minutes (you can still sign in with an e-mail code); wrong Vault key attempts pause similarly. Each e-mailed code works once, for 10 minutes, and allows five tries; you can request up to three codes in 10 minutes. Annoying for the forgetful, prohibitive for the guessing.
Tip
Reception computer? Set vault auto-lock to 1 hour and never use "remember Vault key" on shared machines.