# How to Log Out All Devices After Password Reset

**URL:** <https://community.auth0.com/t/how-to-log-out-all-devices-after-password-reset/190104>\
**Category:** Get Help\
**Tags:** user-password-management, user-management\
**Created:** [August 4, 2025, 9:31am UTC](https://community.auth0.com/t/how-to-log-out-all-devices-after-password-reset/190104 "2025-08-04T09:31:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sanjana.shah](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sanjana.shah/32/71203_2.png) [@sanjana.shah](https://community.auth0.com/u/sanjana.shah)\
**Post date:** [August 4, 2025, 9:31am UTC](https://community.auth0.com/t/how-to-log-out-all-devices-after-password-reset/190104/1 "2025-08-04T09:31:37Z")

</div>

Hi everyone,

I’m working on a flow where users should be logged out from all devices/sessions once they reset their password. I want to ensure that after a password reset, all existing sessions are invalidated across all devices and browsers.

Is there a recommended way to implement this using Auth0?  
I’ve looked into options like rotating refresh tokens and revoking sessions, but I’m not sure of the best approach or if there’s built-in support for this use case.

Additionally, I’ve experimented with the Post Change Password Trigger, but I’m unclear on the precise implementation details and how to effectively invalidate tokens on other devices using this approach.

Any guidance or examples would be greatly appreciated!

---

<div class="post-metadata">

**Author:** ![dawid.matuszczyk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dawid.matuszczyk/32/74550_2.png) [@dawid.matuszczyk](https://community.auth0.com/u/dawid.matuszczyk)\
**Post date:** [August 4, 2025, 6:24pm UTC](https://community.auth0.com/t/how-to-log-out-all-devices-after-password-reset/190104/4 "2025-08-04T18:24:47Z")

</div>

Hi @sanjana.shah

Welcome to the Auth0 Community!

Thank you for posting your question. First of all it’s worth to mention that resetting a user’s password makes their session expire on the Auth0 server side, but note that there are different session layers (please see [Sessions](https://auth0.com/docs/sessions-and-cookies#session-layers))  
and invalidating the Auth0 session layer does not mean invalidation of the Application session layer. The application would need to clear the local application session; a different browser would have its own local session via cookies, for example.

There’s no best answer to the question of what is the best approach, as it will depend. Here’s a link to the Solution from Knowledge Solution that should clear what the options are with Auth0 right now → [User is Not Logged Out after Password Reset](https://community.auth0.com/t/user-is-not-logged-out-after-password-reset/117702#p-299408-solution-4)

It’s not mentioned in the post, so please keep in mind that the Access Tokens and ID Tokens cannot be revoked, as this is by design. Depending on the use case, you can lower the lifetime for the Access Tokens or ID Tokens and use refresh tokens.

Thanks!  
Dawid

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [August 18, 2025, 6:25pm UTC](https://community.auth0.com/t/how-to-log-out-all-devices-after-password-reset/190104/5 "2025-08-18T18:25:16Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.