Checking Email Sessions and Connected Apps
Where to find the devices signed in to your email and the apps connected to it, how to tell what belongs to you, and how to remove access you do not recognise.
Two places in your email settings quietly reveal who has access to your account: the list of signed-in devices and sessions, and the list of connected apps. Attackers who get in often leave a session open or connect an app to keep access even after you change your password. Checking both takes five minutes.
Signed-in devices and sessions
In your account's security settings, look for "Your devices", "Recent activity", "Where you're signed in" or "Sessions". You will see a list of phones, computers and browsers with approximate locations and times.
How to read it
- Recognise your devices: your phone model, your laptop, your work computer.
- Be careful with locations: estimates can be off, especially on mobile data.
- Look for unfamiliar device types, such as a Windows computer when you only use a Mac.
- Check times against when you were actually online.
What to do
- Sign out any session you do not recognise.
- If there is anything suspicious, use "sign out of all other sessions", then change your password.
- Turn on two-step verification if it is not already on.
Connected apps and third-party access
Look for "Third-party apps", "Connected apps", "Apps with account access" or "Permissions". These are services you allowed to use your account, perhaps years ago: calendar tools, games, email apps, sign-in with your account on other websites.
What to remove
- Apps you do not recognise.
- Apps you no longer use.
- Apps with broad permissions, such as reading and sending email, that do not need them.
Why this matters after a hack: a connected app or open session can keep an attacker's access alive even after you change your password. Always check both when recovering an account.
Also check
- Forwarding and filters. See malicious email rules.
- Recovery details. See email recovery settings.
- App passwords, if your provider uses them for older email apps. Remove any you do not need.
Make it a habit
Review sessions and connected apps every few months, and immediately after any suspicious alert, a lost phone, or leaving a shared device. Many providers offer a security checkup tool that walks through these steps.
Got a security alert you are unsure about? Paste it into CyberWatch AI Scan for a free check, then review the activity yourself.
For more, see how to secure your email account and our guide to identity theft and account security.
Frequently asked questions
Why do I see locations I have never been to?
Location estimates are based on internet addresses and can be inaccurate, especially on mobile data. Look at the device type and time too. If you are unsure, sign out that session and change your password.
Does changing my password sign out other devices?
Often, but not always. Use the 'sign out of all other sessions' option to be sure.
What are connected apps?
Third-party apps and services you allowed to access your email or account data, such as calendar tools, games or older email apps. Some keep access until you remove it.
Sources
- Recovering a hacked account, UK National Cyber Security Centre
- Privacy Checkup, Google
- How Websites and Apps Collect and Use Your Information, US Federal Trade Commission
