Session Kill Switch
Where to revoke sessions, tokens and devices on 40 platforms, fastest first.
Step 0: clean the infected device first
Work from a clean device. Pick the infected one above for reset steps and a matching checklist.
Checklist
Picks and ticks stay in this browser. Nothing is sent.
How it works and FAQBackground readingInfostealersSession hijackingAiTM phishing
How to use the checklist
Pick the infected device and your accounts, then work down seven tiers, email and identity first. Each entry links to the provider's settings page (as of October 2026) and records the time you tick it.
Tags say what an entry revokes. The yellow line says what a password change leaves behind; amber chips count open tokens, app grants and devices.
Session kill switch FAQ
Why is changing my password not enough?
Infostealers copy session cookies, which stay signed in until revoked. A password change rarely touches OAuth grants, API tokens, app passwords or linked devices.
Does this tool sign me out of my accounts?
No. It shows where each revoke setting is and in what order; you revoke while signed in. Picks stay in this browser.
In what order should I revoke sessions?
Clean the device first, then email and identity, the password manager, money, work identity, code and cloud, social, and the rest. Email first, since every recovery runs through it.
What if a crypto wallet was on the infected device?
Assume the seed phrase is exposed. Move funds to a new wallet made on a clean device, then revoke token approvals for the old addresses.
Can I link straight to one platform?
Yes. Add its id after a hash, for example /tools/session-kill-switch/#github, and the page opens that entry.
Only platforms with a verified revoke path are listed. The checklist never signs in to anything for you.