I was curious how long do you think we should keep users logged in before they're required to sign in with username and password again?

I was wondering if there's any resources or studies done to show that there's been better user experience when keeping users logged in longer vs shorter.

  • It depends. One factor is what is exposed when logged in: bank account? photos? ability to buy things? the ability to just see non-personal things? Editing your question with more details would get you better answers. Dec 11 '18 at 14:43

The length of a user staying logged in until they are automatically logged out depends on the sensitivity of the data. While it is perfectly fine for a bank to sign out their users after 5 or 10 minutes of idling, this would be a very frustrating experience for a social network or online shop.

There is no direct rule and for as far as I know not even a study about the session length, as it highly depends on your platform and what the users are supposed to do. The question you should be asking is, how important is the user data security to you?

This will lead you to the question "how short do you keep your customers logged in?". And more important than the time is, how you should logout your users. Instead of using a direct time-span, it should be an idle time, like banks are using it. But that last part is just me philosophing around.

I attached you a some links that might help you.


I think as long as possible, without posing a security risk. You should make some rules and consistently improve upon them. Like start with @marvinpoo recommended idle time. Then you can add later on check for impossible behaviour like requesting two pages within microseconds, change of location within a browsing session(use this with grain of salt as mobile networks keep changing I.P), too many 404s.

I think you should also learn from big names like facebook and google. They take more than just time in consideration. They hardly ever log you out. When you are accessing something sensitive ask for password again, but not log them out. Only log them out after days of inactivity. You could refresh authentication token at every 24 hours with 30 days of expiry, and then ask for password again when they access something sensitive(of course with some validity period).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.