# Reset all login tokens **URL:** \ **Category:** Feature\ **Created:** [8 Abril , 2014 20:39 UTC](https://meta.discourse.org/t/reset-all-login-tokens/14590 "2014-04-08T20:39:15Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![riking](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/riking/32/170938_2.png) [@riking](https://meta.discourse.org/u/riking)\ **Post date:** [8 Abril , 2014 20:39 UTC](https://meta.discourse.org/t/reset-all-login-tokens/14590/1 "2014-04-08T20:39:16Z")
With the recent [Heartbleed](http://heartbleed.com/) vulnerability, I think it would be a good forward-looking feature to be able to **reset/clear all user login tokens** , and maybe some other breach recovery-oriented operations. There doesn’t need to be any actual UI for this, just a TUI. (This post was inspired by Github resetting all login tokens after they upgraded their OpenSSL versions.) (edit) I think this accomplishes it: ```sql UPDATE users SET auth_token = NULL -- WHERE all rows ; ``` ---
**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\ **Post date:** [9 Abril , 2014 01:56 UTC](https://meta.discourse.org/t/reset-all-login-tokens/14590/2 "2014-04-09T01:56:04Z")
Sure, Why not add a “stats” tab to `https://sitename/admin/users` it can display some statistics about users … how many were online in the last hour, how many total, how many logged in sessions. And provide a big button to “log out all users” available to admins only. Can you spec this out in greater detail so I can convert to a mini-spec? ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [9 Abril , 2014 04:36 UTC](https://meta.discourse.org/t/reset-all-login-tokens/14590/3 "2014-04-09T04:36:59Z")
Those stats are already available at the bottom of the admin homepage so it would be kind of a duplicate page.. ---
**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\ **Post date:** [9 Abril , 2014 04:43 UTC](https://meta.discourse.org/t/reset-all-login-tokens/14590/4 "2014-04-09T04:43:46Z")
I am thinking about a more detailed view into users. We have some high level stats on dashboard. But we could go into more details there. Reset auto tokens definitely does not belong on the dashboard. ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [9 Abril , 2014 05:03 UTC](https://meta.discourse.org/t/reset-all-login-tokens/14590/5 "2014-04-09T05:03:59Z")
There may also be times for whatever reason that you need to kick everyone off the site, even invalidate all logins. I know we did this about once a year on average at Stack Exchange. ---
**Author:** ![fefrei](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fefrei/32/119538_2.png) [@fefrei](https://meta.discourse.org/u/fefrei)\ **Post date:** [19 Maio , 2016 11:43 UTC](https://meta.discourse.org/t/reset-all-login-tokens/14590/6 "2016-05-19T11:43:04Z")
A mass-logout button would be awesome! Related use cases are [here](https://meta.discourse.org/t/how-to-programmatically-log-out-lots-of-users/37611) and [here](https://meta.discourse.org/t/re-purposing-a-discourse-installation-for-a-yearly-event/34670). ---
**Author:** ![riking](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/riking/32/170938_2.png) [@riking](https://meta.discourse.org/u/riking)\ **Post date:** [20 Maio , 2016 03:37 UTC](https://meta.discourse.org/t/reset-all-login-tokens/14590/7 "2016-05-20T03:37:48Z")
Reading this again, I take back my position in the OP: there probably does need to be UI for this. Perhaps nearby the backup/recovery section of the admin panel. ---
**Author:** ![fefrei](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fefrei/32/119538_2.png) [@fefrei](https://meta.discourse.org/u/fefrei)\ **Post date:** [20 Maio , 2016 04:59 UTC](https://meta.discourse.org/t/reset-all-login-tokens/14590/8 "2016-05-20T04:59:49Z")
Semantically, I’d look for it in the _Users_ section. But _Backup_ is probably fine, too 🙂 Another related feature would be an option to reset all passwords (in case of a breach). ---
**Author:** ![chapoi](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/chapoi/32/537252_2.png) [@chapoi](https://meta.discourse.org/u/chapoi)\ **Post date:** [4 Dezembro , 2025 11:10 UTC](https://meta.discourse.org/t/reset-all-login-tokens/14590/9 "2025-12-04T11:10:02Z")