Skip to content
ENExplore Calculators

Session Timeout Calculator

Choose idle and absolute session timeouts, and see the re-authentication rate, hijack window and PCI or NIST compliance they give you.

About Session Timeout Calculator

Two timers run at once. The idle timer is reset by activity and defines how long a stolen session token remains useful; the absolute timer ignores activity and caps total session age. Which one users actually notice depends on whether their think time exceeds the idle setting. The idle timeout is the length of the window an attacker gets from a hijacked cookie on an unlocked laptop, and it is also the setting users complain about most, so it is worth choosing deliberately rather than inheriting a framework default.

Formulas

Session Timeout

When users pause longer than the idle timeout they are logged out roughly every (gap + idle) minutes; otherwise the absolute timeout alone forces re-authentication.

idle timeout
Inactivity allowed before the session is destroyed
absolute timeout
Maximum session age regardless of activity
gap
Typical think time between user actions

Compliance thresholds

PCI DSS requires re-authentication after 15 minutes idle; NIST SP 800-63B sets 30 minutes inactivity and 12 hours absolute for AAL2, and 15 minutes with 12 hours for AAL3.

AAL2
Authenticator assurance level 2 — multi-factor authentication required
12 hours
720 minutes, the AAL2 and AAL3 reauthentication ceiling

Worked example

With the default values below, Session Timeout Calculator returns Re-Authentications per User per Day of 1. Change any input above and every figure here is recalculated in your browser.

Inputs used

Idle timeoutaccepts 1–1,440 minutes
15 minutes
Absolute timeoutaccepts 5–20,160 minutes
480 minutes
Typical gap between user actionsaccepts 0.5–240 minutes
6 minutes
Hours the application is used per dayaccepts 0.5–24 hours
9 hours
Concurrent usersaccepts 1–10,000,000 users
5,000 users
Server-side state per sessionaccepts 32–65,536 bytes
800 bytes

Results

Re-Authentications per User per Day
1
Stolen-Session Usable Window
15m
Sessions Held Including Expiring Ones
6,250
Session Store Memory
4.77 MiB
Meets the PCI DSS 15-Minute Idle Rule
Yes
Meets NIST SP 800-63B AAL2
Yes

Step by step

  1. 1Values used
  2. 2Session Timeout
  3. 3Compliance thresholds
  4. 4Re-Authentications per User per Day= 1
  5. 5Stolen-Session Usable Window= 15
  6. 6Sessions Held Including Expiring Ones= 6,250
  7. 7Session Store Memory= 5,000,000.00
  8. 8Meets the PCI DSS 15-Minute Idle Rule= Yes
  9. 9Meets NIST SP 800-63B AAL2= Yes

Assumptions and limits

  • The result is derived only from the 6 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Session Timeout calculated?

When users pause longer than the idle timeout they are logged out roughly every (gap + idle) minutes; otherwise the absolute timeout alone forces re-authentication. Two timers run at once. The idle timer is reset by activity and defines how long a stolen session token remains useful; the absolute timer ignores activity and caps total session age. Which one users actually notice depends on whether their think time exceeds the idle setting.

Why does Session Timeout matter?

The idle timeout is the length of the window an attacker gets from a hijacked cookie on an unlocked laptop, and it is also the setting users complain about most, so it is worth choosing deliberately rather than inheriting a framework default.

What values do I need to enter?

This calculator takes 6 inputs: Idle timeout, Absolute timeout, Typical gap between user actions, Hours the application is used per day, Concurrent users, Server-side state per session. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Do I need both an idle and an absolute timeout?

Yes. Idle-only sessions can be kept alive indefinitely by any background polling the page does, and absolute-only sessions leave an abandoned browser logged in for hours. OWASP recommends both, with the absolute timeout tied to how long a legitimate session could plausibly need.

What does PCI DSS require for session timeouts?

PCI DSS requires that an idle session in the cardholder data environment be re-authenticated after no more than 15 minutes. NIST SP 800-63B is separate and stricter in its own way: 30 minutes of inactivity and 12 hours absolute at AAL2, tightening to 15 minutes of inactivity at AAL3.

Related Calculators

Session Timeout Calculator | Calcrivo