131 apps and platforms, their documented session timeouts, and an honest verdict on each. Rather a lot of them are “no”.
Every timeout below carries a link to the vendor’s own documentation. Where we could not find a published number we say so rather than inventing one — a directory that guesses is worse than no directory. Defaults also change, and your administrator may have changed them already, so treat these as the starting point for a measurement rather than a promise.
Almost every session timeout is one of four things, and only the first can be beaten from a browser.
An idle timer slides forward on every authenticated request — refreshing works. An absolute lifetime expires a fixed period after you signed in, whatever you do — refreshing is useless. Token-based auth depends on renewing a credential rather than on page activity. Activity detection watches real mouse and keyboard input, which no page reload resembles.
The trap worth knowing: several popular stacks only renew your session on a request that arrives past the halfway point of the window. ASP.NET Core’s cookie authentication re-issues the cookie only on “a request which is more than halfway through the expiration window”, and Salesforce ignores activity in the first half of its window. Refresh one of those every two minutes and every single request lands too early to count: the session dies exactly on schedule while your countdown looks perfectly healthy. Aim for roughly two-thirds of the window — past halfway, with room for one refresh to go missing.
And if the app is self-hosted, check whether the timeout is simply a setting. Raising glide.ui.session_timeout, session.gc_maxlifetime or the equivalent takes a minute and beats refreshing forever.
A real idle timer that any authenticated request slides. Intervals assume a plain sliding session — on ASP.NET Core or Salesforce, see the halfway trap above and go past the halfway mark instead.
| Product | Documented timeout | Interval | Source |
|---|---|---|---|
| Cloudflare dashboard Cloud & infrastructure admin consoles | 72 hours of inactivity idle timer | 24 hours | doc |
| GitLab (self-managed and GitLab.com) Cloud & infrastructure admin consoles | unverified — the cited settings page states no default idle timer | 2 days | doc doc |
| Grafana (self-hosted) Cloud & infrastructure admin consoles | 7 days inactive (login_maximum_inactive_lifetime_duration); 30 days absolute maximum (login_maximum_lifetime_duration); auth tokens rotate every 10 minutes while the user is active mixed | 2 days | doc |
| Jenkins Cloud & infrastructure admin consoles | HTTP session timeout defaults to what the webapp specifies and then to 60 minutes (--sessionTimeout); idle sessions are evicted after 1800 seconds / 30 minutes by default (--sessionEviction) idle timer | 10 minutes | doc |
| Kibana (Elastic) Cloud & infrastructure admin consoles | 3 days of inactivity (xpack.security.session.idleTimeout); 30-day maximum session lifespan (xpack.security.session.lifespan) on self-managed deployments mixed | 1 day | doc |
| OPNsense web GUI Cloud & infrastructure admin consoles | unverified — OPNsense documents the field as "Time in minutes to expire idle management sessions" but publishes no default, and the config key system.webgui.session_timeout is unset out of the box idle timer | ≈⅔ of window | doc doc |
| Synology DSM Cloud & infrastructure admin consoles | Configurable "Logout timer (minutes)", any value from 1 to 65535. Vendor default value: unverified — Synology documents the setting and its range but not its shipped default. idle timer | ≈⅔ of window | doc |
| TrueNAS (SCALE / Community Edition web UI) Cloud & infrastructure admin consoles | 300 seconds (5 minutes) token lifetime by default; maximum 2,147,482 seconds (about 24 days) idle timer | 100 seconds | doc |
| VMware vCenter Server / vSphere Client Cloud & infrastructure admin consoles | 120 minutes of idle time idle timer | 40 minutes | doc |
| pfSense (Netgate) web GUI Cloud & infrastructure admin consoles | 240 minutes (4 hours) idle idle timer | 80 minutes | doc |
| PowerSchool SMS (school SIS) Education & training — K-12 SIS | 20 minutes of inactivity — 'By default, after 20 minutes of inactivity in the system PowerSchool SMS presents the user with a session timeout dialog.' idle timer | 6–7 minutes | doc doc |
| Blackboard Learn (Anthology) — Inactive Session Timeout Education & training — LMS | 180 minutes (3 hours) default; configurable 15–480 minutes. Warning shown at least 6 minutes before expiry. idle timer | 60 minutes | doc |
| Canvas LMS (Instructure) Education & training — LMS | 24 hours (86,400 s) in the open-source default: `expire_after: 86400 # 1 day in seconds`, and `config[:expire_after] ||= 1.day` in the session-store initializer. Instructure-hosted accounts are set per-customer by Instructure and may differ. idle timer | 8 hours | doc doc |
| D2L Brightspace Education & training — LMS | 180 minutes. Config variable `d2l.SessionTimeout` (Org level), documented Default Value 180 — 'Determines the length of time (in minutes) before a user's session expires during periods of inactivity.' idle timer | 60 minutes | doc |
| Moodle LMS (self-hosted and Moodle Cloud) Education & training — LMS | 8 hours (28,800 s) — admin setting `sessiontimeout`, default `8 * 60 * 60`. Warning fires 20 min before (`sessiontimeoutwarning`, default `20 * 60`). idle timer | ≈⅔ of window | doc doc |
| Ellucian Banner 9 Self-Service (Banner Student / General SSB) Education & training — university SIS | 1,500 seconds (25 minutes). 'If defaultWebSessionTimeout is not specified, a default value of 1500 seconds is used.' idle timer | 8 minutes | doc |
| Oracle PeopleSoft PIA (PeopleTools) — incl. Campus Solutions Education & training — university SIS | Inactivity Logout 1,200 seconds (20 minutes) for authenticated users; Inactivity Warning 1,080 seconds (18 minutes). idle timer | 6 minutes | doc |
| Salesforce (Lightning/Classic web UI) Enterprise SaaS — CRM | 2 hours (default). Range 15 minutes to 24 hours; settable org-wide and overridden per Profile. idle timer | 40 minutes | doc doc |
| HubSpot Enterprise SaaS — CRM / marketing | 24 hours by default, admin-configurable mixed | 8 hours | doc doc |
| SAP Fiori launchpad / S/4HANA (ABAP backend session) Enterprise SaaS — ERP | 30 minutes, fixed on the ABAP backend idle timer | 10 minutes | doc doc |
| ServiceNow (Now Platform UI16/Next Experience) Enterprise SaaS — ITSM / admin console | 30 minutes (glide.ui.session_timeout default) idle timer | 10 minutes | doc doc |
| Confluence — Data Center & Server Enterprise SaaS — dev tools (self-hosted) | 60 minutes idle — Tomcat <session-timeout> in web.xml idle timer | 20 minutes | doc |
| Jira Software / Jira Service Management — Data Center & Server Enterprise SaaS — dev tools (self-hosted) | 300 minutes (5 hours) idle — Tomcat <session-timeout> in web.xml idle timer | 100 minutes | doc |
| Zendesk (end users / Help Center) Enterprise SaaS — support desk | 8 hours of inactivity (default) idle timer | 2 hours 40 minutes | doc |
| Smartsheet Enterprise SaaS — work management | Web sessions 19 hours, desktop 72 hours (defaults). Configurable 15 minutes to 30 hours on Enterprise. idle timer | 6 hours | doc doc |
| ASP.NET Core cookie authentication Frameworks & platform defaults | ExpireTimeSpan = TimeSpan.FromDays(14) and SlidingExpiration = true in the CookieAuthenticationOptions constructor. Microsoft's own sample overrides to 20 minutes, and most real deployments set 20–60 minutes. idle timer | ≈⅔ of window | doc doc |
| Devise :timeoutable (Rails) Frameworks & platform defaults | 30 minutes — `@@timeout_in = 30.minutes`, documented as "Time interval to timeout the user session without activity." Not enabled by default; :timeoutable must be added to the model's devise modules. idle timer | 10 minutes | doc doc |
| Laravel Frameworks & platform defaults | 120 minutes — config/session.php `'lifetime' => env('SESSION_LIFETIME', 120)`. `'expire_on_close' => env('SESSION_EXPIRE_ON_CLOSE', false)`. idle timer | 40 minutes | doc doc |
| PHP (built-in sessions) Frameworks & platform defaults | session.gc_maxlifetime = 1440 seconds (24 minutes). session.cookie_lifetime = 0 ("until the browser is closed"). idle timer | 8 minutes | doc |
| Spring Boot / Apache Tomcat (servlet sessions) Frameworks & platform defaults | 30 minutes in both layers. Spring Boot: `private Duration timeout = Duration.ofMinutes(30);` for server.servlet.session.timeout ("Session timeout. If a duration suffix is not specified, seconds will be used"). Tomcat conf/web.xml ships `<session-timeout>30</session-timeout>`, commented as the default for all newly created sessions. idle timer | 10 minutes | doc doc |
| Plesk (control panel) developer and self-hosted tools | 30 min of idle time (Session Idle Time) idle timer | 10 min | doc doc |
| RStudio Server / Posit Workbench developer and self-hosted tools | 60 min of inactivity (`auth-timeout-minutes`); `auth-stay-signed-in-days` = 30 days, but only takes effect when auth-timeout-minutes is 0 idle timer | 20 min | doc doc |
| phpMyAdmin developer and self-hosted tools | 1440 s (24 min) — `$cfg['LoginCookieValidity']` idle timer | 8 min | doc |
| California EDD — UI Online and myEDD government — unemployment benefits | 30 minutes idle, with a warning 5 minutes before expiry idle timer | 10 minutes | doc doc |
| Salesforce platform (the substrate under many government, payer, benefits and financial-services portals) platform — underlies regulated portals | 2 hours idle (default); admin-selectable from 15 minutes to 24 hours idle timer | 65 minutes | doc doc |
Refreshing slides the clock, but something else — an absolute cap, an SSO session, a form you would lose — limits how much that helps.
| Product | Documented timeout | Interval | Source |
|---|---|---|---|
| Proxmox VE web UI Cloud & infrastructure admin consoles | 2 hours (authentication ticket lifetime); the open web UI renews the ticket every 15 minutes mixed | 30–60 minutes | doc |
| UniFi Network / UniFi OS console Cloud & infrastructure admin consoles | unverified unclear | ≈⅔ of window | doc |
| Unraid webGUI Cloud & infrastructure admin consoles | unverified unclear | ≈⅔ of window | doc doc |
| Schoology (PowerSchool Learning & Engagement) Education & training — K-12 LMS | unverified unclear | ≈⅔ of window | doc doc |
| Cornerstone OnDemand (CSOD) Education & training — corporate LMS | 60 minutes idle on secure pages — 'If a user has been idle for over 60 minutes (no mouse clicks or key presses), a session timeout message will appear.' The general portal session timeout is a separate per-portal backend value and is unverified. watches real input | 20 minutes if you try it at all | doc |
| HealthStream Learning Center (HLC) Education & training — healthcare compliance training | unverified — HealthStream operates a session-timeout warning page (`/HLC/WarnSessionTimeout.aspx`), confirming an inactivity timeout exists, but no public documentation states the default in minutes. unclear | ≈⅔ of window | doc doc |
| Oracle Fusion Cloud Applications (ERP / HCM / SCM) Enterprise SaaS — ERP | Idle: 120 minutes. Absolute session lifetime: 8 hours. Both predefined. mixed | 40 minutes | doc |
| Oracle NetSuite Enterprise SaaS — ERP / accounting | Idle: 180 minutes (3 hours) default, configurable 15–720 minutes. Absolute: 12 hours regardless of activity. PCI roles: 15 minutes, forced. mixed | 60 minutes | doc doc |
| Workday Enterprise SaaS — HCM / finance | unverified — tenant-configured. Commonly 15–30 minutes in practice; Workday forces 15 minutes for PCI user accounts and it cannot be modified. Workday's own admin documentation is behind Workday Community login and no public vendor page states a shipped default. idle timer | 5 minutes | doc doc |
| Atlassian Cloud (Jira / Confluence / JSM on atlassian.net) Enterprise SaaS — dev tools (cloud) | 30 days idle session duration (default). Configurable 15 minutes to 30 days. Atlassian Government Cloud: 24 hours. mixed | ≈⅔ of window | doc doc |
| Zendesk (agents / team members) Enterprise SaaS — support desk | 60 minutes of inactivity (default). Plus a mandatory 12-hour absolute cap from sign-in. mixed | 20 minutes | doc doc |
| Django Frameworks & platform defaults | SESSION_COOKIE_AGE = 1209600 (2 weeks). SESSION_SAVE_EVERY_REQUEST = False. SESSION_EXPIRE_AT_BROWSER_CLOSE = False. mixed | ≈⅔ of window | doc doc |
| Express / express-session Frameworks & platform defaults | cookie.maxAge: "By default, no maximum age is set" (browser-session cookie). rolling: "The default value is false." resave: "The default value is true." saveUninitialized: "The default value is true." mixed | ≈⅔ of window | doc |
| Keycloak Frameworks & platform defaults | UNVERIFIED. Keycloak's documentation describes each setting but the pages I could reach do not publish the default values. SSO Session Idle 30 minutes and SSO Session Max 10 hours are the widely repeated figures; I could not confirm them against vendor docs and will not assert them. mixed | ≈⅔ of window | doc |
| NextAuth.js / Auth.js Frameworks & platform defaults | session.maxAge = 30 * 24 * 60 * 60 (30 days). session.updateAge = 24 * 60 * 60 (24 hours), documented as "Throttle how frequently to write to database to extend a session. Use it to limit write operations. Set to 0 to always update the database." idle timer | ≈⅔ of window | doc |
| Okta Frameworks & platform defaults | 2 hours — "The default session lifetime is two hours", and "The session lifetime determines the maximum idle time of a user's Okta session, and when the session expires." Okta's own guidance recommends "A session lifetime of two hours or less." mixed | 40 minutes | doc doc |
| Adminer developer and self-hosted tools | unverified — Adminer documents no timeout of its own; the effective window is PHP's `session.gc_maxlifetime` (PHP default 1440 s / 24 min) idle timer | 8 mins | doc doc |
| Apache Airflow (FAB auth manager web UI) developer and self-hosted tools | 43200 min = 30 days of non-activity (`[fab] session_lifetime_minutes`) idle timer | 10 days | doc |
| Coder (self-hosted) developer and self-hosted tools | 24 h session, automatically refreshed (sliding) idle timer | ≈⅔ of window | doc |
| JupyterHub (jupyterhub-idle-culler) developer and self-hosted tools | 600 s (10 min) — jupyterhub-idle-culler `--timeout` default. The Littlest JupyterHub ships `services.cull.timeout` = 3600 s (1 h). idle timer | 5 min minimum | doc doc |
| Keycloak (SSO / OIDC broker) developer and self-hosted tools | SSO Session Idle = 30 min; SSO Session Max = 10 h; Access Token Lifespan = 5 min mixed | 10 mins | doc doc |
| Snowflake (Snowsight UI and programmatic sessions) developer and self-hosted tools | SESSION_UI_IDLE_TIMEOUT_MINS = 1080 min (18 h) for Snowsight, raised from 240 min (4 h) by BCR bundle 2026_01; SESSION_IDLE_TIMEOUT_MINS = 240 min (4 h) for programmatic clients idle timer | ≈⅔ of window | doc doc |
| WordPress admin (wp-admin) developer and self-hosted tools | Auth cookie: 2 days (172800 s), or 14 days with "Remember Me" — computed once at login. Nonces: 86400 s (1 day) via `nonce_life`. mixed | ≈⅔ of window | doc doc |
| cPanel / WHM developer and self-hosted tools | unverified — the commonly cited default is 2 h (7200 s) of inactivity, but I could not confirm it from cPanel's own documentation, so treat the number as unconfirmed idle timer | ≈⅔ of window | doc doc |
| SAP Ariba (Ariba Network, Buying & Invoicing — supplier and procurement portals) enterprise — procurement | 30 minutes idle idle timer | 10 minutes | doc doc |
| HRSA 340B OPAIS (340B Office of Pharmacy Affairs Information System) government — healthcare / drug pricing program | 30 minutes idle idle timer | 10 minutes | doc |
| Okta (identity provider fronting many regulated portals) identity provider — SSO in front of regulated systems | Global session: 2 hours lifetime by default. Admin Console: Okta recommends 12-hour lifetime and 15-minute idle timeout per NIST guidance; maximum allowed 24 hours lifetime / 2 hours idle mixed | — | doc doc |
| Stripe Dashboard payments — merchant console | unverified — Stripe does not publish a session length unclear | — | doc doc |
| Django-based government and healthcare portals (framework behaviour worth knowing) self-hosted / framework — common under public-sector portals | SESSION_COOKIE_AGE defaults to 1209600 seconds (2 weeks); SESSION_SAVE_EVERY_REQUEST defaults to False mixed | — | doc doc |
The clock here is not an idle clock. Refreshing costs a page load and buys no time at all.
| Product | Documented timeout | Interval | Source |
|---|---|---|---|
| AWS IAM Identity Center — permission set (AWS account console access) Cloud & infrastructure admin consoles | 1 hour by default for a newly created permission set; configurable 1–12 hours absolute lifetime | — | doc |
| AWS Management Console (IAM user sign-in) Cloud & infrastructure admin consoles | 12 hours by default (IAM users); role sessions capped at 1 hour when chained absolute lifetime | — | doc |
| AWS Management Console (federated / custom identity broker) Cloud & infrastructure admin consoles | 12 hours by default (IAM users); role sessions capped at 1 hour when chained absolute lifetime | — | doc |
| AWS access portal (IAM Identity Center user interactive session) Cloud & infrastructure admin consoles | 8 hours by default; configurable 15 minutes to 90 days (129,600 minutes) absolute lifetime | — | doc |
| Azure Portal / Microsoft Entra admin center Cloud & infrastructure admin consoles | No documented default value. "Sign me out when inactive" is off unless a user sets it, and the directory-level idle timeout is off unless a Global Administrator enables it. Default: unverified/none. watches real input | — | doc doc |
| DigitalOcean control panel Cloud & infrastructure admin consoles | 12 hours absolute lifetime | — | doc |
| Google Cloud Console Cloud & infrastructure admin consoles | configurable 1–24 hours; no published preset default absolute lifetime | — | doc doc |
| Blackboard Learn (Anthology) — Active Session Termination Education & training — LMS | 12 hours default; configurable 3–24 hours. Enabled by default for FedRAMP / IL4 institutions. absolute lifetime | — | doc |
| Google Classroom / Google Workspace for Education Education & training — LMS / identity | 14 days default web session length for Google services. Admin console sessions are fixed at 1 hour and 'can't be modified.' token-based | — | doc |
| Coursera Education & training — MOOC | unverified — Coursera does not publish a session or idle timeout value. unclear | — | doc |
| Open edX / edx.org (and Django-based LMS platforms generally) Education & training — MOOC / LMS platform | 14 days (1,209,600 s) — Django's `SESSION_COOKIE_AGE` default, which Open edX inherits. Open edX's own middleware notes: 'session expiration will be handled by Django's SESSION_COOKIE_AGE, which defaults to 1209600 (2 weeks, in seconds).' absolute lifetime | — | doc doc |
| Zoho (Zoho One / accounts.zoho.com) Enterprise SaaS — business suite | 30 days by default for a Zoho account sign-in ('you can access your account without signing in again for the next 30 days, even if you quit the browser'). Zoho One admins can additionally impose a Session lifetime and an Idle session timeout; defaults for those two are not published. mixed | — | doc doc |
| Slack Enterprise SaaS — communication | No idle timeout by default. Where configured, session duration minimum is 28800 seconds (8 hours), maximum 315569520 seconds (10 years). absolute lifetime | — | doc doc |
| Airtable (Enterprise) Enterprise SaaS — database / work management | unverified — Airtable's admin panel documentation describes a 'Fixed web session length' setting ('Set how long users can stay signed into airtable.com') but publishes neither a default value nor an allowed range. absolute lifetime | — | doc |
| Asana Enterprise SaaS — work management | No default expiry. The former 14-day automatic logout was deprecated on 27 January 2022. Where configured, session limits run from 1 hour to 30 days. absolute lifetime | — | doc doc |
| monday.com Enterprise SaaS — work management | 'Never logout automatically' by default for both controls. No-activity timeout options are 5, 10, or 15 DAYS; 'Session expired' is a separate absolute duration. mixed | — | doc doc |
| AWS Cognito (user pools) Frameworks & platform defaults | "By default, the refresh token expires 30 days after your application user signs into your user pool", configurable "to any value between 60 minutes and 10 years". Managed login sessions "are set in a browser cookie and are valid for one hour". ID/access token default of 1 hour is documented on the app-client settings page, which I did not open in this pass — treat that specific number as unverified here. token-based | — | doc doc |
| Auth0 Frameworks & platform defaults | Defaults UNVERIFIED — Auth0 documents the caps, not the starting values. Inactivity timeout "will be superseded by system limits if over 4,320 minutes (3 days) for non-Enterprise plans or 144,000 minutes (100 days) for Enterprise plans"; Require log in after is capped at "43,200 minutes (30 days) for non-Enterprise plans or 525,600 minutes (365 days)" for Enterprise. mixed | — | doc doc |
| Firebase Authentication Frameworks & platform defaults | "Firebase ID tokens are short lived and last for an hour; the refresh token can be used to retrieve new ID tokens." Refresh tokens "expire only when one of the following occurs: The user is deleted, The user is disabled, [or] A major account change is detected for the user." "Firebase Authentication sessions are long lived." token-based | — | doc |
| Microsoft Entra ID Frameworks & platform defaults | Access token: "a random value ranging between 60-90 minutes (75 minutes on average)", extendable to 24–28 hours under Continuous Access Evaluation. Refresh Token Max Inactive Time: 90 days. Single- and Multi-Factor Refresh/Session Token Max Age: "Until-revoked". Non-persistent session tokens have a Max Inactive Time of 24 hours; persistent, 90 days. token-based | — | doc |
| Ruby on Rails (ActionDispatch CookieStore) Frameworks & platform defaults | None by default. The default store is a cookie store, and with no :expire_after set the session cookie is a browser-session cookie with no server-side expiry. mixed | — | doc doc |
| Supabase Auth Frameworks & platform defaults | "Most applications should use the default expiration time of 1 hour" for the JWT/access token. Refresh tokens "never expire but can only be used once", with a reuse interval that "By default ... is 10 seconds". "By default, all sessions are active until the user signs out." token-based | — | doc |
| Argo CD developer and self-hosted tools | 24 h (`users.session.duration` in argocd-cm) absolute lifetime | — | doc doc |
| Databricks (all-purpose compute auto-termination) developer and self-hosted tools | Inactivity period is admin-set per compute; the 120-minute UI default is UNVERIFIED in vendor docs — the docs describe the mechanism but state no default. Web session idle is reported as 6 h and non-configurable, also unverified. watches real input | — | doc doc |
| GitHub Codespaces developer and self-hosted tools | 30 min default; user-configurable 5–240 min watches real input | — | doc doc |
| Gitpod Classic developer and self-hosted tools | 30 min of no user input; drops to 5 min if the editor/IDE disconnects; configurable up to 24 h watches real input | — | doc |
| Home Assistant developer and self-hosted tools | Access token `expires_in` = 1800 s (30 min); long-lived access tokens valid 10 years; refresh tokens have no documented inactivity expiry token-based | — | doc |
| Jellyfin / Plex Media Server developer and self-hosted tools | unverified — neither documents an idle expiry for web-client access tokens; Jellyfin API keys and Plex tokens are long-lived by default token-based | — | doc doc |
| Kubernetes Dashboard developer and self-hosted tools | 900 s (15 min) — `--token-ttl` default on the JWE token the Dashboard issues absolute lifetime | — | doc doc |
| Nextcloud developer and self-hosted tools | `session_lifetime` = 86400 s (24 h) after inactivity; `remember_login_cookie_lifetime` = 15 days idle timer | — | doc |
| OctoPrint developer and self-hosted tools | unverified — OctoPrint documents no idle logout for the web UI by default; "Remember Me" issues a persistent login cookie unclear | — | doc |
| Pi-hole v6 web interface developer and self-hosted tools | 1800 s (30 min) — `webserver.session.timeout` idle timer | — | doc |
| Replit developer and self-hosted tools | unverified — Replit does not publish a specific idle timeout for workspaces or for Autoscale deployment scale-to-zero mixed | — | doc doc |
| code-server developer and self-hosted tools | unverified — code-server documents no idle session timeout; the password cookie is long-lived unclear | — | doc |
| Login.gov government — identity provider | unverified as a single number; Login.gov's documented position is that session management after handoff is the agency's responsibility token-based | — | doc doc |
| USCIS online account (myUSCIS) government — immigration | unverified for session inactivity. Separately documented: accounts showing 270 days of inactivity are automatically locked, and 20-minute lockout after repeated failed passwords unclear | — | doc |
| IRS Direct Pay government — tax payments | 15 minutes idle (Session Inactivity page) idle timer | — | doc |
| Epic Hyperspace / Hyperdrive (clinical EHR workstation) healthcare — EHR clinical client | unverified as a global default; Epic exposes per-user session timeout options (commonly 20/30/45/60/90/120 minutes) under Personal Options, gated by what the organisation permits watches real input | — | doc |
| Oracle Health / Cerner PowerChart healthcare — EHR clinical client | unverified watches real input | — | doc |
| PayPal (account dashboard and checkout) payments — consumer and merchant | unverified — no vendor-published figure; community reports range from very short to ~30 minutes and are not authoritative mixed | — | doc doc |
A reload actively destroys something: your place in a queue, an upload, a quiz attempt, unsaved work, or the session itself.
| Product | Documented timeout | Interval | Source |
|---|---|---|---|
| Moodle — quiz attempt in progress (mod_quiz) Education & training — LMS assessment | Governed by the same 8h `sessiontimeout`; quiz autosave runs every 60 s by default (`quiz/autosaveperiod`, default `60`). idle timer | — | doc doc |
| Udemy / Udemy Business Education & training — MOOC / corporate course library | unverified — no published session or idle timeout. unclear | — | doc doc |
| LinkedIn Learning Education & training — consumer/corporate course library | unverified token-based | — | doc doc |
| SCORM / AICC / xAPI course players (Articulate Storyline & Rise, Rustici Engine, SCORM Cloud, and any LMS-hosted course window) Education & training — course content player | Not applicable — the player has no session timeout of its own; it inherits the host LMS's. The risk here is data loss, not expiry. unclear | — | doc doc |
| Online proctoring systems (Proctorio, Respondus LockDown Browser & Monitor, Honorlock, ProctorU, Examity, ExamSoft/Examplify) Education & training — remote proctoring | Not applicable — we refuse regardless of the value. watches real input | — | doc doc |
| Notion Enterprise SaaS — docs / knowledge base | 180 days (default for managed users on Enterprise). Configurable 1 hour to 180 days. absolute lifetime | — | doc doc |
| Bank of America online banking banking — consumer | unverified — 10 minutes is widely reported; we could not confirm it on a Bank of America page idle timer | — | doc doc |
| JPMorgan Chase online banking banking — consumer | unverified — the 15-minute figure is widely repeated but we could not confirm it on a Chase-published page idle timer | — | doc doc |
| Wells Fargo online and mobile banking banking — consumer | unverified — Wells Fargo confirms automatic sign-off exists but publishes no interval idle timer | — | doc |
| Truist online and mobile banking (and US bank service agreements generally) banking — terms of service | unverified idle timer | — | doc doc |
| Charles Schwab brokerage | unverified — Schwab confirms inactivity logout but does not publish the interval idle timer | — | doc doc |
| Robinhood brokerage | unverified unclear | — | doc doc |
| Fidelity (NetBenefits and brokerage) brokerage / retirement plan | unverified — Fidelity's login pages surface a ?timeout=true state but no published interval was found idle timer | — | doc |
| HIPAA Security Rule — automatic logoff, 45 CFR §164.312(a)(2)(iii) compliance framework — healthcare | unverified — the rule names no number; it requires 'electronic procedures that terminate an electronic session after a predetermined time of inactivity' idle timer | — | doc doc |
| PCI DSS 4.0 Requirement 8.2.8 (compliance control, not a product) compliance framework — payments | 15 minutes idle, then re-authentication required idle timer | — | doc |
| Tyler Technologies Odyssey File & Serve / eFileTexas (state court e-filing) courts — e-filing | unverified — Tyler publishes a timeout warning but not the interval; instances show a 60-second final warning idle timer | — | doc doc |
| PACER / CM-ECF (US federal court records and e-filing) courts — e-filing and records access | unverified — the PACER Service Center does not publish a session inactivity figure unclear | — | doc doc |
| Google Colab (free and Pro) developer and self-hosted tools | 12 h absolute maximum, documented. The widely repeated "90-minute idle timeout" is UNVERIFIED — the official FAQ only says "Runtimes will time out if you are idle" without a number. mixed | — | doc doc |
| Vaultwarden / Bitwarden web vault developer and self-hosted tools | Client-side vault timeout, user-selected (5 min, 1 h, custom); default timeout action is Lock watches real input | — | doc |
| CMS Enterprise Portal (Medicare/Medicaid provider and plan systems, e.g. HETS, HPMS, MARx, PECOS front doors) government — healthcare administration | 30 minutes idle idle timer | — | doc |
| SAM.gov (US federal contractor registration and procurement) government — procurement | unverified — the widely-quoted '5 minutes' appears to be the final countdown in an expiry modal, not the idle window idle timer | — | doc doc |
| IRS e-Services (and IRIS, FATCA Online Registration, TDC Secure File Sharing) government — tax administration | 15 minutes idle idle timer | — | doc doc |
| HMRC online services (Government Gateway — Business Tax Account, Agent Services, Making Tax Digital) government — tax administration (UK) | 15 minutes idle, with a warning at 13 minutes and a 2-minute grace window idle timer | — | doc doc |
| athenahealth athenaNet healthcare — EHR/practice management web app | unverified idle timer | — | — |
| Epic MyChart (patient portal) healthcare — patient portal | 15 minutes of keyboard inactivity idle timer | — | doc doc |
| Availity Essentials (multi-payer provider portal) healthcare — payer/provider portal | unverified for session inactivity. Separately documented: user accounts deactivate after 60 days of non-use, with a warning email at 55 days idle timer | — | doc doc |
| Square Dashboard payments — merchant console | 75 minutes idle (vendor community post by Square staff, not formal documentation) idle timer | — | doc doc |