Security session timeout exposure calculator

Calculate modeled expiration by session and sessions active at audit with your own figures.

Your numbers

Use the units shown. Results update as you change valid inputs.

Use modeled expiration by session and sessions active at audit to compare changes to your inputs. The method and limits below explain the scope.

Examples

Examples

Try the starting example

Sessions: ID, created YYYY-MM-DDTHH:MM on fixed-offset clock
S1,2026-10-20T09:00 S2,2026-10-20T09:10
Activity: record ID, session ID, time; or none
A,S1,2026-10-20T09:05 B,S1,2026-10-20T09:12 C,S1,2026-10-20T09:25 D,S2,2026-10-20T09:15
Idle timeout whole minutes
10
Absolute timeout whole minutes
30
Audit timestamp
2026-10-20T09:26
Modeled expiration by session
S1: 2026-10-20T09:22; S2: 2026-10-20T09:25
Sessions active at audit
None
Sessions expired at audit
S1, S2
Observed activity records at/after prior expiry, ignored
1
Remaining active-session minutes at audit
0
Sessions not yet created at audit
None

Try another scenario

Sessions: ID, created YYYY-MM-DDTHH:MM on fixed-offset clock
S1,2026-10-20T09:00 S2,2026-10-20T09:10
Activity: record ID, session ID, time; or none
A,S1,2026-10-20T09:05 B,S1,2026-10-20T09:12 C,S1,2026-10-20T09:25 D,S2,2026-10-20T09:15
Idle timeout whole minutes
20
Absolute timeout whole minutes
30
Audit timestamp
2026-10-20T09:26
Modeled expiration by session
S1: 2026-10-20T09:30; S2: 2026-10-20T09:35
Sessions active at audit
S1, S2
Sessions expired at audit
None
Observed activity records at/after prior expiry, ignored
0
Remaining active-session minutes at audit
13
Sessions not yet created at audit
None
Calculation method

Calculation method

Modeled expiration by session

Initialize min(created+idle,created+absolute); process observed activities in time order only before current expiry, reset idle without passing absolute expiry.

Sessions active at audit

created≤audit<expiration.

Sessions expired at audit

created≤audit and audit≥expiration.

Observed activity records at/after prior expiry, ignored

An activity at the expiration boundary does not revive an expired session.

Remaining active-session minutes at audit

Sum expiration−audit only for sessions active at audit.

Sessions not yet created at audit

Supplied creation time after audit; exclude from active/expired counts.

Symbols and units
a
Sessions: ID, created YYYY-MM-DDTHH:MM on fixed-offset clock
b
Activity: record ID, session ID, time; or none
c
Idle timeout whole minutes
d
Absolute timeout whole minutes
e
Audit timestamp

Use the units shown. A list keeps the order in which you enter its values. The symbol ^ means “raised to the power of”.

Assumptions & limits

Assumptions & limits

  • A literal fixed-offset session timeout trace under supplied idle/absolute rules. It does not inspect cookies, detect attackers, enforce session revocation or connect to an authentication system.
Are these inputs private?

These calculations run in your browser. A shared link contains the values you choose to share. Only questions submitted to the separate AI finder are sent to OpenAI.

Further reading

NIST SP 800-53: background for inventory, access, audit and contingency controls; worksheet algorithms and rules are explicitly supplied, not NIST compliance tests ↗

Background reading; this does not imply endorsement or independent review of SumFizz.

Share this page
Share this calculator

Leave unchecked to share the page without your entered values.