Accounts end up open in places their owners forgot: a school computer, a friend's tablet, an old console. Roblox's answer is a section called Where you're logged in, which shows every signed-in session and lets you end any of them remotely. Everything below is taken from Roblox's help center as of September 15, 2026, mainly the articles Session Management and Delayed Actions.
If someone is inside the account right now and changing things, skip to the section on sessions that are not yours, then read how to recover a hacked Roblox account.
Find the Where you're logged in list
- Log in to Roblox.
- Open Settings. On the website it is the gear icon in the upper-right corner; in the mobile apps, tap the three-dots More icon first.
- Select the Security tab.
- Scroll down to the Where you're logged in section.
Each entry is one logged-in session, shown with its device, an approximate regional location, and when it was last active.
Read the list before you clear it
Some entries look alarming and usually are not:
- The location is approximate. Roblox calls it a regional location, so a nearby city on its own does not mean a stranger.
- Unknown entries. Roblox says some sessions show incomplete information or none at all and display as Unknown. These are older sessions whose details are missing because they have been inactive.
- Devices you forgot. An old console, a family computer, or a browser you tried once can still be listed.
The entries that deserve attention are a device type nobody in your household uses, or a recent last-active time on a session you cannot place.
End one session
- In Where you're logged in, select the session.
- Review its device details, location, and last active time.
- Select Log out of session.
Use this when you know exactly which device should go and want to keep the rest signed in.
End every session except this one
At the bottom of the section, select Log Out of All Other Sessions. Every session other than the one you are using is signed out. It is the faster choice when the list is long or right after a password change; the cost is logging back in on your own devices.
If a session is not yours
Logging out a stranger removes them for now, but anyone who has your password can log straight back in. Pair the log-out with a lock-down, in this order:
- Remove malware and unknown extensions first. Roblox's hacked account article says to get rid of harmful downloads and browser extensions before recovering, and its account safety article states there are no official Roblox browser extensions.
- Change the password to one you use nowhere else, following how to change your Roblox password.
- Select Log Out of All Other Sessions, so nothing opened with the old password stays open.
- Turn on 2-Step Verification in the same Security tab, walked through in how to set up 2FA on Roblox.
If Robux or items are already gone, Roblox's hacked account article says it can help only in very limited circumstances, and you must contact support within 30 days of the compromise.
Why Roblox made you wait: Delayed Actions
Sometimes Roblox holds a sensitive action even when it really is you. That is Delayed Actions. When a sensitive action comes from an unfamiliar or high-risk session, Roblox starts a mandatory waiting period, which its article describes as typically several hours, and rejects the action until the period ends. The categories it names are significant account changes, moving assets such as Robux or game ownership, and irreversible requests such as a request to be forgotten.
Roblox lists three kinds of trigger: a new device or location, activity that looks like malware or a malicious extension, and activity inconsistent with your usual patterns. During the wait it sends a security notification to your registered email and to your other active devices.
What to do depends on who started it:
- It was you. Wait for the timer to expire, then return and finish the action. Roblox says a passkey or hardware security key that has been on the account for a while will typically bypass the delay, and acting from a device and connection you use often makes a delay less likely. In some cases, such as a very large payout from a community (the feature formerly called groups), no bypass is allowed.
- It was not you. Select No, it's not me in the email or notification. Roblox says this logs the suspicious session out. Then change your password and check your 2-Step Verification settings.
Passkeys and Enhanced Protection
A passkey signs you in with your device's own unlock, such as Face ID, Touch ID, or a screen lock. Roblox's passkey article puts Add Passkey under Settings > Account Info > Login Methods, and advises adding passkeys only to devices you personally own, because anyone who can unlock a shared device could reach the account.
For the strictest setting, Enhanced Protection in the Security tab makes passkeys or hardware security keys mandatory and disables emailed and authenticator-app codes for 2-Step Verification challenges. It requires at least one passkey, a verified email, and either a verified phone number or backup codes. Roblox warns that losing your passkeys means a multi-step recovery process, so set up those backups first.
The Quick Login code trick
Quick Login lets a signed-in device approve a new one. The new device shows a one-time code valid for 5 minutes, and you enter it under Quick Login in the Settings of the device already signed in, then choose Grant Full Account Access. Roblox's instruction is to only enter codes you requested and never enter another user's code.
So anyone who sends you a code to type in, whether to verify you, hand out free Robux, or fix a trade, is asking for full access to your account. Free Robux offers are always scams; why free Robux is a scam and common Roblox scams cover the other patterns.
A habit worth keeping
Roblox's own safety advice is to log out when you finish playing, especially on shared computers at school or a friend's house. When that slips, the Where you're logged in list is the backstop: check it after a password change, after using someone else's device, and whenever a Delayed Action alert arrives that you did not cause. More protections are collected in how to secure your Roblox account and the other Safety guides.