Session Kill Switch
A checklist for anyone hit by infostealer malware or a stolen session cookie: it shows where to revoke sessions, tokens and linked devices on 40 platforms, in the order that cuts the attacker off fastest.
Your picks, ticks and incident date stay in this browser. Nothing is sent anywhere.
Step 0: clean the infected device first
Work from a clean device. Pick the infected one above for reset steps and a matching checklist.
Checklist
How the session kill switch works
A site gives your browser a session cookie or token after sign-in. Infostealers copy those. Whoever holds one is signed in as you, with no password or MFA prompt, until the session is revoked. Some services end sessions on a password change. Many do not, and almost none touch OAuth grants, API tokens, app passwords or linked devices.
- Pick the infected device to load the platforms a stealer on that system usually reaches, along with reset steps for the device itself.
- Pick your accounts one by one, search for them, or add a set (Developer, Crypto, Work admin, Gamer).
- Work down the checklist. Entries are grouped in seven tiers: email and identity, password manager, money and crypto, work identity, code and cloud apps, social and chat, everything else. Each entry has the steps, a link to the provider's settings page and a tick box that records the time.
- Copy or download the report with the infected date, what is done and the steps still open.
Links go to each provider's settings page as of October 2026. If a page moves, the menu path in the steps still names the setting.
How to read the checklist
The tags on each entry say what it revokes: sessions, devices, apps (OAuth grants), tokens and keys, app passwords, or seed phrase. The yellow line under the steps says what a password change leaves behind on that service. The amber chips above the list count the open entries that still have tokens, app grants, app passwords or linked devices, since those survive a password change until you revoke them. When every entry is ticked, keep watching for new sign-in alerts for two weeks.
Session kill switch FAQ
Why is changing my password not enough?
Infostealers copy the session cookies and tokens a site gives your browser after sign-in. Whoever holds one is signed in as you, with no password or MFA prompt, until the session is revoked. Some services end sessions on a password change, but almost none touch OAuth grants, API tokens, app passwords or linked devices.
Does this tool sign me out of my accounts?
No. It tells you where each revoke setting is and in what order to use them, with a link to the provider's settings page. You do the revoking yourself while signed in to each service. Your picks and ticks are saved in this browser only and nothing is sent anywhere.
In what order should I revoke sessions?
Clean or reset the infected device first and work from a clean one. Then go through email and identity, the password manager, money and crypto, work identity, code and cloud apps, social and chat, and everything else. Email comes first because recovery for every other account runs through it.
What if a crypto wallet was on the infected device?
A browser wallet has no session to revoke. Assume the seed phrase is exposed if the wallet was unlocked or the phrase was saved on that device. Create a new wallet on a clean device, move the funds there first, then revoke token approvals for the old addresses.
Can I link straight to one platform?
Yes. Add the platform id after a hash, for example /tools/session-kill-switch/#github. The page adds that platform to your checklist, opens its steps and scrolls to it. The Stealer Exposure Check uses these links in its next-step column.
Only platforms with a verified revoke path are listed. The checklist never signs in to anything for you.