Review devices signed in to your Google account

Start with the account, then the devices

An old laptop in your Google device list can mean an ordinary forgotten sign-in. An unfamiliar entry can warrant action. The useful question is whether each session still belongs there, rather than whether the list matches the number of gadgets on your desk.

This guide uses a personal Google Account in a desktop web browser. You can review access without holding the other device. Work and school accounts may require help from your administrator; this walkthrough does not cover organization controls or phone-specific settings.

1. On a computer you trust, open your Google Account. Check the account address before proceeding, especially if you use separate personal and work accounts.
2. Select Security & sign-in. Under Your devices, choose Manage all devices. Google's documented shortcut is google.com/devices.
3. Open a device or session to inspect it. The list includes current access and activity from recent weeks; Signed out identifies ended sessions.

If the page unexpectedly asks you to sign in, check the address before entering credentials. Navigate from the links above instead of following an alarming message. A familiar logo in an email is not a reason to trust its destination.

Read the evidence without overreading it

Google explains that one device can produce several sessions through different browsers, apps, private windows or verification. Activity times include background syncing, and locations can be approximate. A recently reset device can also remain listed. These details make a single odd entry a clue to investigate, rather than proof of intrusion.

Before deciding, make a short inventory of the computers and phones you actually use. Include borrowed machines and any device you recently sold, returned or reset. Keep this inventory private: device names, travel history and account addresses do not belong in a public support post.

Compare details together. A browser you remember using on a borrowed computer is a useful explanation; a device you cannot place after checking your own history deserves removal. Avoid inventing a reassuring story just because a location is nearby. Equally, avoid treating every duplicate name as a separate stranger.

Hypothetical example: you own one laptop and one phone but see four sessions. That count alone does not establish that two extra people have access. Write down which entries you can explain and which you cannot; the unexplained entries, rather than the total, determine your next action.

Use three decisions: keep access you recognize and still need, end access you recognize but no longer need, and investigate access you cannot explain. You do not need to wait for evidence of damage before ending an uncertain session.

Sign out the old or uncertain sessions

In the device details, choose Sign out and complete any confirmation Google presents. For repeated entries with the same device name, Google advises signing out every matching session when you need to exclude access from another device. Return to the list and check for Signed out. See Google's device-access guidance for the documented behavior.

Work through your removal decisions individually. Keep your own working session available while you do this, and distinguish it carefully from the session you intend to end. This is especially useful when several entries have generic names.

Save any visible error before trying again. If the list appears unchanged, reopen the details rather than assuming the first click worked. If you have the unwanted device in hand, check whether accessing Google now requires sign-in; do not sign back into a borrowed or sold machine merely to test it.

If you accidentally sign out your own device, the practical recovery is to sign in again with your normal credentials and required verification. Check that you can complete those checks before deliberately removing access you still rely on. There is no benefit in creating a second access problem during routine housekeeping.

Treat remote sign-out as an account-access action. Do not assume that it erases downloaded documents, screenshots or other local copies. Before selling a device, you still need a separate data-removal process appropriate to that device. The review also cannot tell you whether someone previously copied information.

If an entry remains unexplained, review the account

Do not stop at tidying the list if you suspect someone else signed in. Google's compromised-account instructions add a separate event review:

1. Return to Security & sign-in. On Recent security events, select Review security events.
2. For an event you did not perform, select No, it wasn’t me and follow Google's security steps.
3. Review account recovery details and security settings for changes you did not authorize. Strengthen sign-in protection, including 2-Step Verification, as directed by Google's guidance.

If you cannot get into the account, use Google Account recovery. Ending another session does not resolve a changed password or missing recovery method. Use a trusted device for remediation if you suspect the computer itself is compromised.

Write down the unexplained event and what you changed, without copying passwords or verification codes into your notes. This gives a later review something concrete to compare. A recognizable device list does not settle unexplained account changes, so follow the broader security guidance when those remain.

A password change has exceptions; app access is separate

If unauthorized access is suspected, change your password through Security & sign-in → How you sign in to Google → Password. Verify yourself if asked, enter a new password, then select Change Password. Google's password guidance warns that changing or resetting it leaves exceptions: verification devices, some devices with authorized third-party apps, and authorized helpful home devices. Continue the device review rather than assuming a password change ends everything.

Also inspect Google's linked apps page. Under Access to your Google Account, select an unfamiliar or unwanted app, choose See details, review its access, then use Remove access → Confirm if appropriate. Google's linked-app documentation distinguishes this from Stop using Sign in with Google, which stops automatic sign-in without deleting data held by the app.

Read the connection type before removing it. Breaking a useful connection can interrupt its features; reconnecting later requires authorization again. Account sign-out, password replacement and app-access removal answer different questions. Finish when the remaining sessions are accounted for, unwanted connections are addressed, and any unexplained security events have gone through Google's response process.