Skip to content
ENExplore Calculators

Session Timeout Policy Calculator

Work out session timeout policy instantly with clear inputs, formula shown and shareable results.

About Session Timeout Policy Calculator

Two timeouts are needed. The idle timeout bounds how long an unattended session on a shared machine remains usable, and OWASP suggests 15 to 30 minutes for sensitive applications. The absolute timeout caps total session lifetime regardless of activity, which limits the value of a stolen session cookie that the attacker keeps alive with periodic requests.

Formula

Session timeout policy

hijack window = idle timeout; forced re-authentication interval = absolute timeout; recommended idle = 15 min high, 30 min medium, 60 min low sensitivity

Worked example

With the default values below, Session Timeout Policy Calculator returns Recommended idle timeout of 15. Change any input above and every figure here is recalculated in your browser.

Inputs used

Idle timeoutaccepts 1–1,440 min
15 min
Absolute session lifetimeaccepts 0.25–720 h
8 h
Average active session lengthminimum 1 min
35 min
Data sensitivityone of Low - public or internal content, Medium - business data, High - financial, health or admin
High - financial, health or admin

Results

Recommended idle timeout
15 min
Window an abandoned session stays usable
15 min
Absolute session lifetime
480 min
Policy assessment
Idle timeout meets guidance for this sensitivity level

Step by step

  1. 1Values used
  2. 2Session timeout policy
  3. 3Recommended idle timeout= 15 min
  4. 4Window an abandoned session stays usable= 15 min
  5. 5Absolute session lifetime= 480 min
  6. 6Policy assessment= Idle timeout meets guidance for this sensitivity level

Assumptions and limits

  • The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to whole numbers, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Why is an absolute timeout needed as well?

An attacker with a stolen cookie can keep the session alive indefinitely by sending traffic. Only an absolute lifetime forces re-authentication.

Does a long timeout hurt security if MFA is enforced?

MFA protects login, not an already-established session. Session theft through XSS or a shared machine bypasses it entirely, so timeouts still matter.

Related Calculators

Session Timeout Policy Calculator | Calcrivo