Sign-in Security
Review your recent sign-ins, spot the ones you don't recognize, and manage the trusted browsers that skip two-factor authentication.
Why It Matters
The fastest way to catch an account takeover is to look at where your account has actually been used. Kit records every sign-in attempt — successful or failed — and shows you the history in plain language. If something in the list wasn’t you, one button ends every other session, revokes every browser your account trusts, and flags the incident for review.
Before You Start
Sign-in security builds on your second factor. Both are managed under Account Settings → Password:
- Two-factor authentication — a verification code from an authenticator app, required at every sign-in.
- Passkeys — device-bound credentials (Touch ID, Face ID, security keys) that replace codes entirely.
If you haven’t set up either yet, do that first. Everything on this page assumes an account worth protecting has a second factor in front of it.
Reviewing Your Sign-in Activity
Open Account Settings → Sign-in activity. The Recent sign-ins table lists your last 20 sign-in attempts:
| Column | What it shows |
|---|---|
| When | Date and time of the attempt |
| Device | Browser and operating system, e.g. Chrome · macOS
|
| Location | City and country, resolved from the network — or “Unknown location” |
| Status | How the attempt ended (see below) |
| Status | Meaning |
|---|---|
| Successful | The sign-in completed normally. |
| Failed | The credentials were wrong. One or two of these are usually just typos — a burst of them is someone guessing at your password. |
| New location | The sign-in succeeded, but came from a country you haven’t signed in from before — or your account changed countries faster than travel allows. |
Tip
Scan this list whenever something feels off — an alert email, a session you don’t remember, a colleague reporting phishing. A sign-in you don’t recognize is the earliest, clearest signal of a compromised password.
Trusted Devices
When you enter a two-factor code, you can tick Trust this browser for 30 days on the verification screen. That browser then skips the code prompt at sign-in — your password alone gets you in on that machine.
How trust behaves:
- It expires. After 30 days the browser asks for a code again.
- It applies to authenticator codes only. Passkey sign-ins never skip anything — a passkey is already bound to your device, so there is no code to skip.
- It’s a token, not a fingerprint. Kit stores no browser fingerprint. Trust lives in a random token in a secure cookie on that browser, rotated at every sign-in, and only a one-way digest is kept server-side.
- A password change wipes it. Changing your password automatically revokes every trusted browser — each one must pass two-factor again.
The Trusted devices section at the top of the Sign-in activity page lists every browser you’ve trusted, with its last-used time. Click Revoke next to a single browser, or Revoke all to clear the list — for example after signing in on a shared or borrowed machine.
Note
Only trust browsers on devices you own and control. On a shared computer, leave the box unchecked — the code prompt is doing its job.
When a Sign-in Looks Wrong
Below the sign-in list you’ll find “Don’t recognize one of these sign-ins?” and a Secure my account button. Clicking it:
- Ends every other session immediately — every browser signed in to your account, except the one you’re on, is signed out on the spot. Remember-me cookies stop working, and a page an intruder still has open goes dark too.
- Revokes every trusted browser — anyone holding your password now faces the two-factor prompt again, everywhere.
- Flags the incident at the highest severity — your “this wasn’t me” report outranks every automated signal and goes straight to the top of the security review queue.
- Takes you to the change-password page to finish the job.
Important
Secure my account cuts off the access an attacker already has — it doesn’t make them forget your password. Until you change it, they can simply sign in again. Complete the flow: “We ended your other sessions and revoked your trusted browsers. Change your password now to finish securing your account.”
New Sign-in Alerts
When your account is accessed from a browser or country you haven’t used before, Kit emails you immediately: “New sign-in to your Kit account”, with the time and location of the sign-in and a link to your sign-in activity.
- If it was you — signing in from a new laptop, traveling — no action is needed.
- If it wasn’t you, open the link, press Secure my account, and change your password.
These alerts are always sent. They aren’t part of your email preferences and can’t be turned off — an attacker who could silence the alarm would defeat its purpose. Your very first sign-in never triggers one; alerts only fire once there’s history to compare against.
What Kit Records and Why
Each sign-in attempt is recorded with its time, browser, coarse location (country, region, city), IP address, and outcome. From that, Kit computes advisory anomaly signals:
| Signal | What it means |
|---|---|
| New country | First sign-in from this country in your recent history |
| New device | First sign-in from this browser and operating system combination |
| Impossible travel | A different country than the previous sign-in, minutes or hours apart |
| Anonymized origin | The sign-in came through Tor, a VPN, or a datacenter IP |
These signals warn — they never block. A flagged sign-in still succeeds; you and your admins just hear about it.
Your Privacy
The record is append-only: entries can’t be edited or deleted after the fact, by anyone — that’s what makes it trustworthy evidence. Device and location details are encrypted at rest, and the activity page shows plain-language summaries only, never raw IP addresses. Trusted-device records are equally private: no fingerprinting, and the device details Kit keeps are encrypted too.
Quick Checklist
- Turn on two-factor authentication or add a passkey under Account Settings → Password.
- Review Sign-in activity and confirm you recognize every entry.
- Revoke trusted browsers you no longer use — especially on shared machines.
- Treat every “New sign-in” email as worth ten seconds: was that me?
- If anything looks wrong: Secure my account, then change your password immediately.