X trusted devices explained and how to manage them: FAQ
What a trusted device actually is
When you sign in on a phone or computer and choose to remember it, or after you complete one 2FA check, that terminal is marked trusted. The upside is fewer codes later; the downside is that if the device is lost or taken, someone may sign in without a code. Understanding this is the premise for managing it well.
How it relates to two-factor authentication
2FA is the per-login extra check, and a trusted device is a skip-pass issued to devices that passed it. Together they stay safe without being annoying. Turning on 2FA but ignoring trusted devices leaves a side door unlocked, so anyone holding your old phone walks straight in.
How to remove an old device
Go to Account security, then Sessions, to see every active device. For anything you do not recognize or no longer use, sign out or remove it. After removal that device must re-verify to sign in, which revokes its pass.
Before switching or selling a device
Before changing phones, remove the old one from the trusted list and then factory reset. A factory reset alone is not enough because the trusted status lives on the account side, not on the machine. Do not skip this before selling, or the buyer may sign in without verification.
When an unknown device appears
An unfamiliar device in the list often means someone holds your session token. The right order: remove it at once, change the password, enable 2FA, and audit connected apps. If you are unsure whether you were hijacked, see our hacked account recovery.
Return to the homepage for more account security guides.
Frequently Asked Questions
What exactly is a trusted device?
It is a terminal where you signed in and chose to remember it. That device can later sign in without a 2FA code, which is convenient but riskier if lost. You can remove it anytime in Account security, after which it must re-verify to sign in.
How do I remove an old phone or computer?
Go to Account security, then Sessions, find the device, and sign out or remove it. After removal it must re-verify next time. Clear the list before switching devices, rather than remembering after the phone is already sold.
How do 2FA and trusted devices relate?
2FA is the per-login extra check; a trusted device is a skip-pass issued to devices that passed it. Together they stay secure without being annoying. See our <a href="/en/blog/x-suspicious-login-alert-response-steps">suspicious login response</a>. Turning on 2FA but ignoring trusted devices leaves a side door unlocked.
What should I do before selling an old phone?
Sign out of X and remove the trusted device, then factory reset. A factory reset alone is not enough because the trusted status lives on the account side, and a buyer could still sign in without verification if you forgot to remove it.
What if I see an unknown entry in the list?
Remove it at once and change the password, then enable 2FA. An unknown device may mean someone holds your session; follow our <a href="/en/blog/recover-hacked-x-account-faq">hacked account recovery</a> steps. After removal, also glance at the authorized apps list.
Check your own X/Twitter footprint
Free on-device scan. Your archive never leaves your computer.
Start Free CheckRelated Reads
How to Enable Two-Factor Authentication on X (2026 Guide)
Turning on two-factor authentication on X is the first line of defense for your account. This guide covers why 2FA matters, how to enable it, authenticator app vs SMS, and how it fits your digital footprint cleanup.
Old Sessions and Forgotten App Grants on X: A Complete Audit
Accounts rarely get taken over through the password. The usual entry points are an app grant approved three years ago and a session still attached to a device you sold. Both survive a password change. Here is the audit order, and why it belongs before any deletion run.
Auditing Connected Apps on X: Finding Standing Access and Revoking It Safely
An authorization granted years ago for a single scheduled post may still be live today. Standing access like this sits outside the password system, so changing the password does not touch it. Here is a checklist for finding, judging and revoking it.