Devices and sessions are not the same thing
Two lists in your profile look similar and mean entirely different things. Confusing them is the most common reason someone revokes the wrong row and wonders why nothing changed.
- Devices are computers running the agent. Each holds a durable token that lets it serve your files.
- Sessions are browsers signed in to the website. Each holds a refresh token that keeps you signed in.
Revoking a session never touches an agent, and removing a device never signs a browser out.
The devices list
Each device shows the name its own machine reports, a display name you can change, when it was last seen, and whether it is online right now.
Rename only changes what you see — useful when three machines all call themselves
DESKTOP-XXXXXX. Reset to default puts the system name back.
Removing a device revokes its token immediately. The agent keeps running but can no longer answer for your account; to use that machine again, pair it with a fresh code — see link a device to your account.
Device hardware
Each linked device reports its processor, memory, graphics adapters (with video memory), operating system, free disk space where AI models are stored, and whether it is a laptop running on battery.
- Profile → Devices: select the chip icon next to a device to see its hardware. While the device is offline you see the last report it sent, with its date.
- AI models & settings: the hardware of the selected device is shown live at the top.
The report is encrypted on the device with your key before it leaves it. Filemote's server keeps only that encrypted copy and cannot read it. After you change your password the copy cannot be opened until the device reconnects and sends a new one. Devices running Filemote older than 1.12.24 do not send a report.
The sessions list
Each session shows the IP address it was created from, what browser it reported, when it started, and which one is current — the browser you are reading this in.
Revoking a session signs that browser out the next time it needs a fresh token. Use it when you have signed in somewhere you no longer control, or when a session's IP is not one you recognise.
Revoke all does more than the name suggests, and the next section is why.
Changing your password unlinks every agent
A password change deliberately clears everything:
- every session, so a stolen refresh token cannot outlive the change;
- every outstanding access token, immediately rather than at its natural expiry;
- every device token, so an agent that someone else may have got hold of is evicted too.
That last one has a practical consequence people do not expect: after changing your password, every device needs pairing again. This is by design — the point of changing a password is to lock somebody out, and leaving durable device tokens alive would leave the door ajar.
The same is true of Revoke all sessions, which clears device tokens along with browser sessions.
Two more things follow from a password change, both worth knowing in advance:
- A running agent keeps the old encryption key until it is restarted, so anything it sends back decrypts to nonsense until you do. The symptom and the fix are in the device shows as offline.
- Share links keep working. Their key travels in the link, not in your password.
Which one do I revoke?
| Situation | What to revoke |
|---|---|
| You signed in on a computer you no longer have | That session |
| A machine was lost, sold or reinstalled | That device |
| You suspect the account itself is compromised | Change the password — it clears both |
| A file link went to the wrong person | The share link — see sharing a file with a link |
Why a device can be listed and still offline
The list is not a heartbeat monitor: it shows a device that is paired, together with when it was last seen. A paired device with an agent that is not running shows as offline, and that is the ordinary case rather than an error. Work down the device shows as offline before removing anything — removing a device is easy to do and takes a pairing code to undo.
Updated 2026-10-01