Sessions and signing out

Each browser you sign in from is a session. You can see and end them at any time.

See your sessions

1. Select your avatar in the top right to open the account menu.
2. Open Sign-in sessions.

Each entry shows the device and browser, how you signed in (password or Google), and when it was last used.

End a session

• Choose End session on any entry to sign that browser out.
• Choose Sign out other sessions to end every session except the one you are using. Do this if you signed in on a shared or lost device.

How long a session lasts

• While you are active, Terra renews your access quietly in the background.
• A session that is not used for 28 days ends.
• Every session ends after 90 days at most, and you sign in again.

Signing out ends the session on the server, not just in your browser.

Password reset

Choose Forgot password? on the sign-in page and enter your email. If a verified account exists, Terra sends a reset link that works once, within 24 hours. Setting a new password ends every session on the account, everywhere.

How sessions are protected

• Terra keeps your session in secure, HttpOnly cookies that page scripts cannot read, and only sends them to Terra.
• Access tokens are signed with Ed25519 and last 15 minutes.
• Each renewal issues a new token. If an old one is ever replayed, Terra ends the whole session.
• Passwords are stored as bcrypt hashes, never as text.
• Repeated failed sign-ins are slowed down, and the error never says whether the email or the password was wrong.