ChatGPT login history and active sessions are not the same thing
OpenAI separates account-security information into two useful views: Security history and Active sessions. They answer different questions.
Security history is designed to help you look backward. It shows recent security events associated with your OpenAI account, such as sign-ins, sign-outs, password changes, changes to multi-factor authentication, passkey changes and other security-setting changes.
Active sessions answers a different question: which OpenAI sessions are still signed in? This is the view you use when you want to terminate an unfamiliar active session.
| Feature | What it shows | What you use it for |
|---|---|---|
| Security history | Recent account-security events such as sign-ins, sign-outs and changes to passwords, MFA, passkeys or other security settings. | Investigating when something happened and whether an event looks familiar. |
| Active sessions | Active browser sessions and first-party OpenAI app sessions known through OpenAI session management. | Reviewing currently active sessions and logging out unknown ones. |
This distinction is important because an old sign-in may remain visible in Security history even after that session has ended, while a currently active session is what you need to remove if you think someone still has access.
Official OpenAI guidance: Keeping your OpenAI account secure and Managing active sessions in ChatGPT .
How to check your ChatGPT security history
OpenAI documents Security history as the place to review recent security events associated with your account.
-
Open ChatGPT on the web. Sign in to the OpenAI account you want to review.
-
Open Settings. Use your profile menu to enter ChatGPT settings.
-
Open the security section. Depending on the interface shown to your account, this may appear as Security or Security and login.
-
Select Security history. This opens the list of recent security events associated with the account.
-
Compare the event details. Review the event type, time, device information and approximate location where those details are available.
What can appear in Security history?
OpenAI says the history can include sign-ins, sign-outs, password changes, MFA changes, passkey changes and changes to other account-security settings.
That makes it useful when, for example, you receive a security notification and want to check whether a password was changed or whether a sign-in happened around the same time.
Source: OpenAI account security guidance .
How to interpret an unfamiliar device or location
An unfamiliar location does not automatically mean someone has accessed your account. OpenAI notes that security details such as location and device information may be approximate or unavailable.
Network routing, mobile carriers, corporate networks, VPNs and changes in IP address can all make a location look different from the place where you physically used ChatGPT. Device descriptions can also be broad, such as a browser family rather than an exact computer model.
Instead of relying on one field, compare several details together.
- Time
- Did the event happen while you were actively using ChatGPT or another OpenAI service?
- Browser or device
- Does the listed browser, device category or app resemble something you normally use?
- Approximate location
- Is it broadly consistent with your network, workplace, VPN or mobile provider?
- Event type
- A password change or unfamiliar MFA change deserves more attention than a location difference on its own.
- Active session status
- Check Active sessions to see whether an unfamiliar session is still signed in.
Do not ignore a combination of warning signs. An unfamiliar location alone may be harmless, but an unfamiliar device combined with a password change, MFA change or active session you cannot explain should be treated more seriously.
How to see which ChatGPT sessions are still active
Active sessions is the part of ChatGPT security settings designed for currently signed-in sessions. OpenAI says a session may represent a browser session or a session in a first-party OpenAI application.
-
Open ChatGPT Settings. Use the account whose active sessions you want to inspect.
-
Select Security. Open the account security controls.
-
Select Active sessions. ChatGPT will display the active sessions available through its session-management system.
-
Find your current session. The device you are using may be labeled CURRENT SESSION.
-
Review the other rows. Compare browser or device information, first-party OpenAI app context, approximate location, sign-in time and trusted-device information where those details are available.
What can an Active sessions row contain?
| Detail | What it means |
|---|---|
| Device or browser | Information about the browser or device associated with that session, when available. |
| App context | The first-party OpenAI product may be shown, such as ChatGPT, Codex or API Platform. |
| Approximate location | A rough location associated with the session. OpenAI warns that session details may be approximate or incomplete. |
| Sign-in date and time | When the session was established, if that information is available. |
| Trusted device status | Whether OpenAI recognizes the device as trusted. |
| Current session | Identifies the session you are currently using. |
Official details: Managing active sessions in ChatGPT .
How to remove one unknown ChatGPT session
If Active sessions shows a device or session you do not recognize, OpenAI allows you to terminate that session individually.
-
Open Active sessions. Go to ChatGPT Settings → Security → Active sessions.
-
Locate the unfamiliar session. Compare its device, location, app and sign-in information with sessions you recognize.
-
Select Log out. OpenAI will show a confirmation dialog.
-
Confirm Log out. The selected session will be terminated.
If the session belongs to a trusted device, OpenAI says the confirmation action may instead appear as Log out and remove. This both ends the session and removes the device from trusted devices.
Why does one row have no Log out button?
OpenAI says an individual row may not offer a Log out action if it is your current session or if the session status is unavailable.
You cannot terminate the current session from its own row. To end it, sign out normally or use the option to log out of all sessions.
If a row says Session status unavailable and you want to remove every possible active login, OpenAI recommends using Log out of all sessions.
If you genuinely do not recognize the session
Logging it out is only the first step
If someone obtained your password or access to your sign-in provider, they may be able to sign in again. After removing the session, secure the credential or identity provider that was used to access the account.
How to log out ChatGPT on every device
If you see several unfamiliar sessions or you are not sure which device belongs to you, ChatGPT also provides a global sign-out option.
-
Open Settings. Go to ChatGPT’s account settings.
-
Open Security or Active sessions. The exact interface may expose the global sign-out control from the security page or inside Active sessions.
-
Select Log out of all sessions. OpenAI may present an additional confirmation such as Log out all.
-
Confirm Log out of all devices. Your current session is also included.
OpenAI says signing out of all active ChatGPT sessions may take up to 30 minutes to propagate to other devices.
That means another device may not disappear instantly the moment you press the button. Allow time for the sign-out to propagate before concluding that the action failed.
Official instructions: How do I log out of all of my devices? .
What to do after finding a session you do not recognize
If you believe an unfamiliar session represents unauthorized access, removing the session should be followed by securing the sign-in method that protects your OpenAI account.
If your OpenAI account uses a password
OpenAI recommends changing your password promptly if you suspect your account has been compromised. Use a strong password that you do not reuse on another service.
OpenAI’s account-recovery guidance states that changing the OpenAI password causes current sessions to be logged out within approximately 30 minutes.
If you sign in with Google
If your OpenAI account uses Google authentication and you believe that sign-in method may be compromised, secure the Google Account itself. OpenAI specifically directs users who authenticate with Google to reset the Google Account password when unauthorized access is suspected.
If you sign in with Microsoft
The same principle applies to Microsoft authentication. If Microsoft is the identity provider used to sign in to OpenAI, secure that Microsoft account rather than looking for a separate ChatGPT password that may not exist.
Review the activity again afterward
Once you have removed the unfamiliar session and secured the sign-in method, return to Security history and Active sessions. Confirm that there are no new unexplained sign-ins or security-setting changes.
Official guidance: I’m seeing unrecognized activity on my OpenAI account and Keeping your OpenAI account secure .
Enable multi-factor authentication after securing the account
Multi-factor authentication adds another verification step during sign-in. OpenAI says the available MFA methods can vary by account, device, country and account configuration.
Depending on what is available to you, options may include an authenticator app, push notification, SMS or WhatsApp verification, or a passkey.
One important detail is that enabling MFA does not automatically terminate sessions that are already signed in.
If you think another person is already inside the account, first terminate the unknown sessions or use Log out of all sessions. Then secure the password or identity provider and enable MFA.
-
Remove suspicious sessions. Log out the unknown session or log out of all sessions if necessary.
-
Secure your sign-in credential. Change the OpenAI password or secure your Google or Microsoft account.
-
Enable MFA. Open the security settings and configure one of the authentication methods available to your account.
-
Store recovery information safely. Keep any recovery method or recovery key somewhere you can access if your primary authentication method is lost.
Official MFA guide: Managing multi-factor authentication .
What Active sessions does not show
The Active sessions page is useful, but it should not be interpreted as a complete record of every authentication relationship connected to your OpenAI account.
OpenAI says Active sessions does not show or manage several categories of access.
| Item | Active sessions behavior |
|---|---|
| Third-party app sessions | Not shown or managed in the Active sessions list. |
| Connected apps | Managed separately from ChatGPT Active sessions. |
| Sign in with ChatGPT sessions used only for third-party services | Not represented as ordinary Active sessions for session management. |
| Codex CLI sessions | OpenAI says these are not shown in Active sessions. |
| Already signed-out sessions | Active sessions only represents sessions that are still active through the session management system. |
One browser row can represent more than ChatGPT
OpenAI also notes that a single browser session can represent access across multiple first-party OpenAI products. You may therefore see app context associated with ChatGPT, Codex or the API Platform rather than a separate browser row for every product.
Organization SSO accounts are an exception
OpenAI says Active sessions is generally available across ChatGPT accounts and workspace types, but not for accounts linked to an organization’s SSO sign-in using systems such as SAML or OIDC.
If Active sessions does not appear and your account belongs to a managed organization, SSO may be the reason. In that case, your organization’s identity and security controls may govern session handling.
Official source: Managing active sessions in ChatGPT .
Why can’t you log out the session you are using now?
OpenAI marks the session you are currently using as CURRENT SESSION. That row cannot be terminated through its own individual Log out control.
If you want to end that session, sign out from ChatGPT normally or choose Log out of all sessions.
This prevents the interface from presenting an individual remote-session control for the browser that is currently managing the session list.
What if the unknown session still appears after you log it out?
A session may not disappear instantly from the interface. OpenAI recommends allowing time for normal propagation and refreshing Active sessions.
If the session remains visible and you do not trust it, use Log out of all sessions. If you suspect unauthorized access, secure your password or external identity provider as well.
If the session list itself cannot load, OpenAI suggests trying again later. Persistent suspicious activity should be escalated through OpenAI Support after you secure the account.
What if ChatGPT shows a Suspicious Activity Alert?
OpenAI says suspicious-activity alerts can be triggered by behavior such as unusual sign-ins, unexpected locations or devices, sudden changes in usage patterns or settings, and unusually high numbers of concurrent sessions.
The alert does not prove that an account was compromised. It is a warning to review the activity and secure the account if necessary.
If the alert appears together with an unfamiliar active session, a password change you did not make or another unexplained security event, follow the account-security steps in this guide promptly.
OpenAI guidance: Why am I receiving a Suspicious Activity Alert? .
Frequently asked questions
Can I see every device that has ever logged into ChatGPT?
Not as a permanent lifetime device list. Security history shows recent security events, while Active sessions shows currently active sessions known through OpenAI’s session-management system.
Can I remove only one unknown ChatGPT session?
Yes. OpenAI’s Active sessions feature allows you to select an individual unfamiliar session and choose Log out. Trusted devices may show Log out and remove instead.
Does logging out one session change my password?
No. Terminating a session ends that session. If you believe someone knows your password or controls your sign-in provider, secure the credential separately.
Does Log out of all sessions include the device I am using now?
Yes. OpenAI says the global sign-out option includes the current session. Other ChatGPT sessions may take up to 30 minutes to be logged out.
Does enabling MFA log out someone who is already signed in?
No. OpenAI specifically says enabling MFA does not automatically terminate existing sessions. Remove suspicious sessions or log out everywhere first if you suspect someone already has access.
Why does the login location look wrong?
OpenAI says device and location details can be approximate or incomplete. Mobile networks, VPNs, corporate networks and IP routing can make the displayed location differ from your physical location.
What if I use Google to sign into ChatGPT?
If you believe the Google-authenticated account has been compromised, secure the Google Account itself. OpenAI directs users who authenticate through Google or Microsoft to reset the corresponding provider password when necessary.
Why can’t I see Active sessions in Settings?
OpenAI says the feature is not available for accounts linked to an organization’s SSO sign-in, including SAML or OIDC. Interface availability can also change over time.
The safest way to respond to an unknown ChatGPT session
Use Security history to understand recent account events and Active sessions to determine which sessions remain signed in.
If you find an unfamiliar active session, log it out. If several devices are suspicious or you cannot confidently identify them, use Log out of all sessions.
Then secure the actual sign-in method: change your OpenAI password if you use one, or secure the Google or Microsoft account if that is how you authenticate. Finally, enable MFA and return to Security history to check for any new unexplained activity.