Secure Your OpenAI Account and Sign Out Unknown Devices

If you think someone else may have accessed your OpenAI account, secure it by changing the password or strengthening your sign-in method, ending active sessions, and checking the email account tied to it. You’ll need access to your account and, ideally, to its recovery email or sign-in provider; menu labels may vary slightly by app or browser.

What You’ll Need

A device you trust and an internet connection.
Access to the email address linked to your OpenAI account.
Your current sign-in method: your password, or access to the identity provider you use, such as Google, Apple, or Microsoft.
A new, unique password if your account uses password sign-in.

Step-by-Step

Use a device you trust. If the computer or phone you usually use may be infected, switch to another device you control. Avoid signing in on a shared or public device. Open the official OpenAI website or app directly rather than following a link in an unexpected email or message.
Change your password if you sign in with one. Open ChatGPT, select your profile menu, and go to Settings. Look for Security and the password-change option, if shown. Follow the prompts. Use a long password that you have not used on another website; a password manager can generate and store one. If you created your account through Google, Apple, or Microsoft, change the password with that provider instead. OpenAI may not offer a separate password to change for accounts that use provider sign-in.
End active OpenAI sessions. In ChatGPT, open your profile menu, then Settings and Security. Choose Log out of all devices or the equivalent session-logout control, and confirm. This signs you out across sessions, not just the device you are using. It may take some time for other sessions to be logged out, so do not assume the change is instantaneous. Sign in again only on devices you recognize.
Secure your sign-in provider and email. If you use Google, Apple, or Microsoft to sign in, review that provider’s security settings and signed-in devices. Change its password if it may be exposed, remove sessions or devices you do not recognize, and enable multifactor authentication if available. Secure your email account too: someone with access to it may be able to reset passwords or intercept security messages. Use a distinct password and review its recovery methods and active sessions.
Turn on stronger sign-in protection where available. In OpenAI account settings, check Security for multifactor authentication options. Follow the on-screen setup and save any recovery codes somewhere private and separate from your device. If the option is not available for your account or sign-in method, use the security features offered by your identity provider. Do not share verification codes or recovery codes with anyone.
Review account activity and connected access. Look through your recent conversations and account settings for changes you did not make. If you use the OpenAI API, review your API keys in the relevant platform settings; revoke any key you do not recognize and create a replacement only for services you trust. Update legitimate applications that used a revoked key. Do not treat a familiar device name or location as conclusive proof either way: network routing and travel can make them look unfamiliar.
Check that your changes worked. After ending sessions, sign in again on your trusted device. Confirm that your security settings are as intended and that your email and identity-provider accounts are secure. If unknown activity continues, change exposed credentials again from a trusted device and contact OpenAI Support through the official Help Center.

Common Mistakes

Changing only the OpenAI password: If you use Google, Apple, or Microsoft sign-in, that provider controls your authentication. Secure the provider and its recovery options too.
Expecting one-device removal: The all-device logout control is designed to end sessions broadly. It may log you out of your own devices as well, and the change may take time to take effect.
Reusing an old password: A password exposed on another service can put the OpenAI account at risk again. Choose a unique one.
Sharing codes with a supposed support agent: Never give anyone your password, one-time verification code, or recovery code. Use official support channels and do not trust unsolicited requests.
Deleting the account before securing access: Account deletion is not the same as logging out sessions and may be difficult or impossible to reverse. First secure your credentials and contact support if you cannot regain control.

Tips

Use a password manager to create a unique password and avoid storing it in a shared browser profile.
Keep your email account protected, since it often serves as the account’s recovery route.
Enable multifactor authentication when the option is available, and store recovery codes offline or in a secure password manager.
Be cautious with links claiming your account is compromised. Navigate to OpenAI directly to sign in or get support.
If you manage API keys, use only the keys you need and revoke a key immediately if it is exposed. A ChatGPT password change does not replace the need to manage API keys.

Troubleshooting

You cannot find “Log out of all devices.” Check the account’s Settings and Security area in ChatGPT, and try the official website if you are using the app, or the app if the website is unavailable. Menu wording and availability can change. If the option still is not shown, contact OpenAI Support through the Help Center.

You cannot sign in to change settings. Use the password-reset or sign-in recovery flow for your account. If you use a third-party provider, recover access through that provider rather than repeatedly trying an OpenAI password. Check that you are using the same sign-in method you used when you created the account.

You no longer control the account email. Try to recover the email account through its provider first. If you cannot, contact OpenAI Support through the official Help Center and explain that you may have lost access. Do not send passwords or verification codes in a support request.

Unfamiliar activity continues after you log out everywhere. Secure your email and identity provider, change any exposed credentials from a trusted device, and review API keys and connected services. If you still see activity you did not authorize, contact OpenAI Support and provide relevant details without including secrets.

Frequently Asked Questions

Does logging out of all devices delete my account?
No. It ends active sessions; it does not delete your account or its data. You can sign in again with your usual method.

Will this log out my own phone and computer?
Yes. An all-device logout can end your own sessions too. Sign in again on devices you trust after the action takes effect.

How long does it take to sign out other devices?
OpenAI notes that it may take up to 30 minutes for other sessions to be logged out. Avoid relying on immediate logout as the only protection; secure your sign-in credentials as well.

Can I remove just one unknown device?
The available control may log out all sessions rather than let you select individual devices. Use it if you suspect unauthorized access, then sign back in only on devices you recognize.

Do I need to change my password if I use Google or Apple sign-in?
Change the password at the provider if you think its account is at risk, and review that provider’s sessions and security settings. The OpenAI account may not have a separate password when you use provider sign-in.

What if I see an API key I do not recognize?
Revoke it in the platform’s API key settings, then check any applications or services that relied on it. Create a new key only for a trusted use, and keep it private.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →