Sign out everywhere

For teachersFor parentsFor studentsFor admins· 2 min read

The panic button for compromised accounts. Invalidates every JWT — including the one you're using now.

If you suspect your account is compromised — stolen phone, leaked PIN, accidentally signed in on a public computer and forgot to sign out — Sign out everywhere is the panic button. It invalidates every active JWT on every device, including the one you're using right now.

Steps

Settings → Security.
Scroll to Sign out everywhere.
Tap the button.
A confirmation dialog opens — "This signs out every device, including this one". Tap Sign out everywhere.
Confirm.

You're signed out immediately on the current device. Every other device gets signed out on its next request (within seconds).

What it does technically

Bumps your account's session epoch.
The session validation in the JWT callback compares this against the value embedded in each JWT.
Mismatch → empty session → redirect to sign-in.

Active CEAs in progress finish gracefully; the next page view requires a fresh sign-in.

When to use it

Suspect a stolen phone. Sign out everywhere first, then call your carrier.
Leaked PIN suspected. (Parents — change the child's PIN too.)
Signed in on a friend's laptop and forgot to sign out. Run this instead of trying to remember where you signed in.
End of term — some teachers run this as a clean break before holidays.

What it doesn't do

Doesn't delete your data.
Doesn't change your password / PIN (you'd do that separately).
Doesn't notify other devices proactively — they discover the kick on next request.

Common issues

Signed out everywhere but old device still works. That session was offline; it'll be kicked the second it reconnects.
Want to be more selective. Currently there's no "kick one specific device" — it's all-or-nothing. We may add a per-device session manager in a future patch.