Every sign-in and every failed attempt, with the place and the device.
Anything unusual for you is flagged — a country you have not signed in from before, a device you have not used, or a run of failed attempts. Failed attempts matter as much as successful ones: forty failures followed by one success is what a break-in looks like, and the success on its own looks perfectly normal.
Change your password. That signs out every other device immediately, including theirs, and cancels any pending request to move your email address. You do not need to contact anybody first.
Change my password and sign everyone else outThe sign-ins below are an example, not your own. Showing your own list here is the next step. The recording is already real: every sign-in, successful or not, is written to a table that cannot be edited or deleted by anyone, including us.
Worth checking: 1 sign-in worth a look. If any was not you, change your password now - that signs out everyone else immediately.
| When | Where | Device | What happened |
|---|---|---|---|
| 13 days agostill signed in | Boston, United States | Chrome on macOS | Signed in |
| 14 days agostill signed in | Boston, United States | Chrome on macOS | Signed in |
| 15 days ago | IP 198.51.100.7 | Unknown device | Blocked - too many triesSomebody was trying passwords |
| 15 days ago | IP 198.51.100.7 | Unknown device | Wrong password |
| 15 days ago | IP 198.51.100.7 | Unknown device | Wrong password |
| 15 days agostill signed in | Boston, United States | Safari on iOS | Signed in |
A sign-in stays usable for 30 days. Attempts are kept for 90 days, successful or not — several failures followed by a success is what an account being broken into looks like, and it is invisible if only successes are kept.