Feature Request: Ability to Manage Active Sessions & Remote Logout

ChatGPT Feature requests
1

:police_car_light: IMPORTANT SECURITY IMPROVEMENT – Remote Session Management Needed :police_car_light:

Currently, ChatGPT does not provide a way to view active sessions or log out remotely. If a user accidentally leaves ChatGPT open on a work, public, or shared device, there is no way to revoke access, putting privacy and security at risk.

This is a critical security flaw that needs to be addressed. Google, Microsoft, and other platforms already offer this feature, allowing users to manage active sessions and log out remotely when needed. OpenAI should implement this as well to protect user privacy and prevent unauthorized access.

:small_blue_diamond: Why This Feature Is Essential:

:white_check_mark: Prevents unauthorized access if ChatGPT is left open on a shared or work computer.
:white_check_mark: Protects private conversations from being viewed by unintended users.
:white_check_mark: Adds an extra layer of security for users managing multiple devices.
:white_check_mark: Standard security practice—many major platforms already provide this feature.

:small_blue_diamond: Suggested Solution:

Add a “Manage Active Sessions” option in ChatGPT settings, allowing users to:

  • View all logged-in devices.
  • Log out from specific devices remotely.
  • Force log out from all devices if needed.

This is a basic security feature that OpenAI needs to implement ASAP. If you agree, please comment, upvote, and share your support so OpenAI prioritizes this request!

:backhand_index_pointing_right: Would this feature be useful to you? Let OpenAI know by commenting below!

2

Hello OpenAI Team,

I’m writing to report a significant security concern regarding ChatGPT’s session management.

After using the “Log out of all devices” option from my account settings, I discovered that active sessions on previously used devices (e.g., a work computer) remain logged in unless the user manually refreshes or clears cookies. The session token remains active in the browser, which allows full continued access — even after attempting to revoke access from another device.

This introduces a serious security gap:
• No true “remote kill” of live sessions — if someone stays on the page, they remain logged in until token expiration (~30 days)
• No visibility or control over active sessions/devices
• No prompt for reauthentication on suspicious or stale sessions

I recommend implementing stronger session controls, such as:
• Immediate session invalidation (force logout on page activity after a logout-all command)
• Active session list and remote logout per device
• Shorter or user-configurable session lifespans
• Forced reauthentication after logout events or location/IP change

These additions would bring ChatGPT’s session security in line with industry best practices for accounts using sensitive or private content.

Thank you for your time and consideration.