User Experience Stack Exchange is a question and answer site for user experience researchers and experts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am in the middle of building a system that will require a session time out. Anyone have a best practice here as far as time to give before it actually times out?

Currently I am planning for a pop up to display "Your session will expire in 15 seconds" with a countdown appearing and two buttons. One saying 'continue' and the other 'log-out'.


share|improve this question
Does this post give you some pointers? -…? – JonW Oct 29 '13 at 9:56

You should make the timeout as long as your security needs will allow. There is no UX benefit to a short timeout.

share|improve this answer
I think he's talking about displaying a notification to someone to let them know their session is about to expire, rather than what the actual session timeout period should be :-) I also wouldn't say there's no benefit to UX with a short timeout... I wouldn't be frustrated if my bank automatically signed me out after 5 minutes of inactivity, because it'd be potentially dangerous to leave it open. I actually feel a bit safer when I do encounter that, even though I have to sign in again. – Kip Oct 28 '13 at 22:02
Maybe I misunderstood, but I read the question again and it still sounds like he's asking the question I answered. Also, the bank website case falls into the "as long as your security needs will allow" caveat. – Jeremy T Oct 28 '13 at 22:36
You are both right. I was asking about the actual session time itself and when we should display the session is about to expire pop up. I love the bank idea of timing your session and resetting upon actions. Really cool, thanks all! – Ryan Oct 29 '13 at 14:28

Of course it depends on the type of application you're building, but you should consider handling and displaying timeouts the way some online-banking-providers do it:


It's a small clock in the corner next to some rarely used sections like "settings" and so on. You can easily see how long your session ist still valid.

And here comes the big UX-Plus: Whenever you perform some action, like transferring money to someone else, the countdown resets to 10 minutes.

This way customers can take as much time as they need. If they forget to log-off - no problem, session does not re-validate itself, since the actions that refresh the session are those that require a password.

share|improve this answer
I'm not sure I'm a big fan of this idea, as a ticking clock will cause some degree of anxiety for users that may not have otherwise been affected by it at all. – Jeremy T Oct 29 '13 at 16:05
@JeremyTunnell you might be correct. but I still feel that it's nicer for the users to know that something is going to happen instead of suddenly telling them "your session timed out!" – Lovis Oct 29 '13 at 16:09
Miller Agreed, but I still think the correct compromise is to show nothing until the last 30 seconds or so before timeout – Jeremy T Nov 1 '13 at 16:10
@JeremyTunnell maybe, someone should make research about it. But I really don't think that many people even noticed the countdown on the banking-webpage. – Lovis Nov 1 '13 at 16:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.