What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Changing a password or rotating a secret does not necessarily end sessions already in use. A browser cookie, application session, identity-provider token, temporary cloud credential, or local client cache may continue authorizing requests without checking the new password. Identify which artifact is still working, then revoke it at the layer that issued or accepts it.
Why a credential change may leave access untouched
A password is usually checked when a user signs in, not on every request afterward. The service may instead accept a session artifact issued earlier. Rotating a password or secret changes the credential used for future authentication; revoking a session invalidates existing authorization state. They are separate operations.
As an Amazon Associate I earn from qualifying purchases.
A single browser sign-in can involve more than one session. An identity provider may authenticate the user and issue tokens, while the application creates its own cookie or server-side session. Revoking the identity-provider session does not automatically invalidate a separate application session. Microsoft puts the responsibility plainly: “To revoke a session token, the application must revoke access based on its own authorization policies.” Microsoft Entra session guidance describes this distinction and warns that revocation may take time to take effect.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteFirst determine what is still working
Before clearing caches or resetting credentials again, distinguish a still-valid session from a failed rotation. Try a new sign-in in a private browser window or another clean client, and separately test the already-open browser or app. If the old credential succeeds in a genuinely new sign-in, the rotation may not have reached the relevant account, service, or credential store. If only an existing session works, investigate the session artifact it holds.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Existing browser or app only: likely an application cookie, server-side session, or identity-provider browser session.
- New sign-in succeeds with the old credential: verify which account, environment, and credential were changed, and whether the new value was saved where the client reads it.
- Command-line tool or SDK still works: check for cached credentials or temporary cloud credentials rather than assuming a browser session is involved.
- Several applications or devices remain active: determine whether they share an identity provider, each maintain their own session, or both.
“Session cache” is not one standardized object. The issuer, validation method, expiry, and revocation controls differ by artifact.
| Artifact still authorizing requests | Who controls it | What to investigate |
|---|---|---|
| Application cookie or server-side session | The application | Whether the server still accepts the session ID, and whether the application has invalidated its session record or session version. |
| Identity-provider refresh token or browser session | The identity provider, with possible application-specific sessions too | Provider revocation controls, token expiry, propagation, and whether the app continues accepting its own cookie. |
| Access token | The token issuer and the resource accepting it | Whether requests are checked online or accepted until token expiry; provider revocation may not instantly affect every resource. |
| Cloud assumed-role credentials | The cloud authorization system and the service using the credentials | Credential issue time, expiry, policy-based cutoffs, and propagation delay. |
| Local CLI or SDK cache | The client on that machine | Whether cached credentials are being reused and how the client obtains a fresh set. |
Revoke the layer that is still accepting access
Application cookie or server-side session
Use the application’s sign-out-everywhere, session-revocation, or administrator controls if available. For a custom application, invalidate the server-side session record or advance the account’s session version according to its design; clearing the browser cookie can remove the local copy, but it does not make a still-accepted server-side identifier invalid. OWASP’s Session Management Cheat Sheet says that when a session expires, the application must actively invalidate it on both client and server.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Identity-provider tokens and sessions
Use the identity provider’s current account-session revocation controls, then account for the application’s behavior. Microsoft Entra guidance notes that an application may issue its own session token after authentication and that Entra cannot directly revoke that application-issued token; the application must enforce its own revocation policy. Provider-side revocation can also take time to become effective.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Microsoft Graph documents revokeSignInSessions as invalidating a user’s refresh tokens and browser session cookies. The cited documentation is for Microsoft Graph beta, which Microsoft says may change and is not supported for production use. Do not build a production runbook around that endpoint without verifying the current supported API version and its behavior.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Microsoft 365 and device sign-in
Microsoft’s product-specific session-timeout guidance gives Microsoft 365 examples of access tokens valid for one hour and refresh tokens valid for 90 days, subject to revocation and the conditions described on that page. Those figures are not general OAuth, browser-cookie, or web-session lifetimes. The page also describes service-specific browser behavior.
A password change does not reliably mean every device immediately loses every form of access. Microsoft’s Primary Refresh Token guidance distinguishes a PRT obtained with a password—which a password change can invalidate—from cached device sign-in behavior and later cloud authorization. Conditional Access session controls can also affect reauthentication: Microsoft’s guidance gives a default rolling sign-in frequency of 90 days in its stated context, but policy and application support determine the outcome. That default is not a universal recommendation.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
AWS assumed-role credentials and CLI cache
AWS documents a policy-based way to deny IAM role temporary credentials issued before a cutoff time. Its console revocation policy sets the cutoff approximately 30 seconds into the future from the action time to allow for policy propagation. That timing is AWS IAM behavior, not a general cloud guarantee.
AWS also documents that the CLI caches credentials until they expire and recommends removing the cache to force a refresh: on Linux or macOS, remove ~/.aws/cli/cache; on Windows, remove the corresponding CLI cache directory. This is a local CLI cache cleanup, not a universal way to revoke browser sessions or server-side application sessions. Follow AWS’s current role-session revocation guidance for the applicable credentials and policy.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Verify that access is actually revoked
- Identify the artifact: use the application, identity-provider, cloud, or client logs to determine whether requests present a cookie, token, temporary credential, or cached client credential.
- Revoke it at the accepting layer: invalidate the app session in the app, use the provider’s supported revocation process for provider tokens, or apply the relevant cloud policy for temporary credentials.
- Refresh the client only where appropriate: sign out or clear a local cache when the client is reusing stale credentials. Do not treat client cleanup as proof that a server has rejected the old artifact.
- Test the old session: make a fresh request using the previously active browser or client session. Confirm that it is rejected or forced through a new authentication flow.
- Check logs and propagation: verify the revocation event and subsequent authorization decisions in the relevant system. Some revocations are not instantaneous, and an application may continue accepting its own session until expiry or synchronization.
If the old session remains usable, revisit the artifact and the system that validates it; rotating the password again will not necessarily invalidate a cookie, token, or temporary credential already accepted elsewhere.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
