Home / Knowledge hub / Remember me
Knowledge hub
Remember me
A long-lived login option, and the extra risk it carries if its token is stolen.
What it means
Remember me is the tick box that keeps a person signed in after they close the browser. Behind it sits a second, long-lived credential, usually a persistent cookie, that the server swaps for a fresh session when the normal one has ended.
It trades convenience for exposure. The ordinary session might last minutes. The remember-me token can last weeks or months, and it sits on the device the whole time, so it needs the care of a session token.
Why it matters
That token is as good as a password for as long as it lives. A copy from a shared computer, a malware-infected laptop or a backup can reopen the account long after the owner stopped thinking about it. If it also skips MFA, the second factor protects nothing.
Done well it costs little. Done badly, it quietly becomes the weakest way into every account, because attackers prefer the credential with the longest life and the fewest checks.
How it shows up
You meet it on sign-in forms, in mobile apps that never ask you to sign in again, and in banking or admin tools that should not offer it at all. The server stores a hashed random token, ties it to the device, and rotates it on each use.
The mistakes repeat. Storing the token unhashed in the database. A predictable value built from the user id. A token that never changes or expires. One that still works after a password change. Sensitive actions allowed without asking again. Require fresh authentication for payments, email changes and settings.
Questions people ask
Remember me, answered
Is remember me safe?
It can be, if the token is random, stored hashed on the server, rotated on use, and cancelled on logout or password change.
It is riskier on shared devices and for high-value accounts, so many teams switch it off there.
How long should remember me last?
There is no fixed figure. Weeks are common for consumer apps, and shorter for business tools. Pick a maximum age and enforce it on the server.
Expire it earlier when the device or location changes sharply.
Should remember me skip two-factor checks?
Often it skips the repeat prompt on a trusted device, but only after the second factor was passed once. It should never bypass the factor for a new device.
Sensitive actions should still ask again.
What should remember me not unlock?
Changing the password or email, adding payment methods, exporting data and admin changes. These deserve a fresh check.
That way a stolen token cannot lock the owner out.
How do we test our remember me feature?
Check token randomness, whether it is rotated, whether it survives a password change, and whether it works from another device.
A pentest can try each of these on the running app and show the request.
Sources
Where this comes from
Related
Terms that sit next to this one
Session timeout
The point at which an idle or old session stops working and sign-in is required again.
Token revocation
Cancelling a token before it expires, for example after a password change.
Session hijacking
Stealing the token that tells your application a browser is logged in.
MFA
A second proof beyond the password, usually a code or a hardware key.
Sliding session
A session whose expiry is pushed back each time the user is active.
What does a stolen token reopen?
Long-lived tokens that survive password changes, skip a second factor or unlock sensitive actions are things we test on the running app, and findings come with the request. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.