Secordit home
Contact

What is session hijacking?

After you sign in, a service usually stores a session credential in your browser. That means you do not have to type your password on every click. That credential is often a cookie or a token. Session hijacking, in everyday terms, is when someone else gets that credential and uses it as if they were you. 12

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

  1. You sign in, and the service stores a session credential, often a cookie or other token, in your browser. 1
  2. If someone else obtains that credential, they may use it to act as you. The NCSC notes that attackers who steal one may use it to take data. 1
  3. A stolen session can still bypass a password check until the service ends it. Some large services try to spot a stolen session being reused. 1

How it can look

The NCSC's MFA guidance discusses stolen session credentials and says a session credential is often a cookie or other token. It also says that forcing everyone to re-enter a password every few hours is not, in the NCSC's view, always a security win. It can even make people more likely to fall for phishing. The NCSC does not state an always-or-never rule about a stay-signed-in box. 1

Warning signs

  • You stay signed in on a shared or borrowed computer, and you leave without signing out of important accounts. 1
  • A device may have malware, which can put session credentials at risk alongside passwords. 1
  • A sign-in or payment is made over a connection that is not protected with HTTPS. A cookie marked secure would not then be travelling only over TLS. 2

What to do now

  1. Sign out of important accounts on devices you do not control, and be careful on shared computers. 1
  2. Use HTTPS, and if you run a service, mark cookies as secure so they travel only over TLS. 2
  3. Keep devices clear of malware, and use MFA or passkeys so that stealing a password alone is less useful. Remember that a stolen session can still bypass a password check until the service ends it. 12

UK reporting and support

  • If you think an account has been taken over, follow the NCSC help for a hacked account. Use the genuine site to end other sessions if the service offers that. 3
  • For fraud or hacking in England, Wales or Northern Ireland, use Report Fraud. In Scotland, call Police Scotland on 101. 467
  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 5
  • If someone is in danger, call 999. 67

How to protect yourself

  • Use HTTPS for sign-ins, and avoid important account use on a shared computer you cannot sign out of. 21
  • Turn on MFA or a passkey, and keep malware off the device. 1
  • If a service lets you see or end other signed-in sessions, use that after any doubt about a lost or shared device. 1

Frequently asked questions

If I tick stay signed in, can someone else use my account without my password?

A session credential can let someone use the account until the service ends that session. The NCSC does not state an always-or-never rule about a stay-signed-in box. Be careful on shared computers, and sign out of important accounts on devices you do not control. 1

Does MFA stop session hijacking?

MFA or a passkey makes a stolen password less useful. A stolen session credential can still bypass a password check until the service ends it. Some large services try to spot a stolen session being reused. 1

Should I be asked for my password every few hours?

The NCSC's view is that forcing everyone to re-enter a password every few hours is not always a security win. It can even make people more likely to fall for phishing. 1

Matching kit

Account Lockdown Kit · £19 · Digital download.

A self-serve guide to securing email, phone and online accounts. It does not promise to stop every attack.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. NCSC, Avoiding MFA anti-patterns | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  2. NCSC, Using TLS to protect data | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  3. NCSC, Help for individuals | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  4. Report Fraud, Report Fraud. Accessed 10 November 2026 (Europe/London).
  5. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 10 November 2026 (Europe/London).
  6. Police Scotland, How to report a crime - Police Scotland. Accessed 10 November 2026 (Europe/London).
  7. Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud. Accessed 10 November 2026 (Europe/London).