Session Timeout Calculator

When users pause longer than the idle timeout they are logged out roughly every (gap + idle) minutes; otherwise the absolute timeout alone forces re-authentication. Two timers run at once. The idle timer is reset by activity and defines how long a stolen session token remains useful; the absolute timer ignores activity and caps total session age. Which one users actually notice depends on whether their think time exceeds the idle setting.

The idle timeout is the length of the window an attacker gets from a hijacked cookie on an unlocked laptop, and it is also the setting users complain about most, so it is worth choosing deliberately rather than inheriting a framework default.

This calculator takes 6 inputs: Idle timeout, Absolute timeout, Typical gap between user actions, Hours the application is used per day, Concurrent users, Server-side state per session. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Yes. Idle-only sessions can be kept alive indefinitely by any background polling the page does, and absolute-only sessions leave an abandoned browser logged in for hours. OWASP recommends both, with the absolute timeout tied to how long a legitimate session could plausibly need.

PCI DSS requires that an idle session in the cardholder data environment be re-authenticated after no more than 15 minutes. NIST SP 800-63B is separate and stricter in its own way: 30 minutes of inactivity and 12 hours absolute at AAL2, tightening to 15 minutes of inactivity at AAL3.