If you changed your Facebook password and you can still log in with the old password, or a device stays logged in even after you changed credentials, it feels like a security nightmare, like the password change did nothing 😅. In many real cases, though, the explanation is less spooky and more technical: a device session is still alive, meaning the device isn’t authenticating with the old password each time, it’s using an already-issued session token that remains valid until it expires or is explicitly revoked, so the device behaves as “logged in” even if the password is now different.
That said, we should treat this seriously because there are two distinct possibilities that look similar but have different risk levels: (1) you are seeing normal session persistence, where a device stays logged in because its session token is still valid, or (2) you are seeing a true password change failure or account compromise, where the old password genuinely still works for new logins. The goal is to distinguish these two quickly and then shut down every session you don’t trust, so your password change actually gives you closure ✅🙂.
Definitions 🧠
Password is what you type during login, but after a successful login, Facebook issues session tokens to your browser or app. Those tokens can keep you logged in without repeatedly re-entering the password.
Device session still alive means a phone, browser, or app session remains valid after a password change. This can happen when the platform does not immediately revoke all sessions on password change, or when the device is trusted and allowed to keep the session, or when you changed the password on one surface and other sessions have not been forced to re-authenticate yet.
Old password still works can mean two things:
- Old password works to unlock an already logged-in session, which is not a real test, because the device didn’t need the password.
- Old password works for a fresh login from a new private session, which is a real red flag and indicates either the password change did not apply correctly or the account state is compromised.
Facebook provides security features like “Where you’re logged in” and “log out of all sessions” behaviors that exist specifically because sessions can persist across devices. This is the tool you use to kill old sessions when you want a hard reset of trust.
Why Important? 😩💛
After a password change, you want certainty. If an attacker previously had access or if you changed the password during a security scare, seeing a device remain logged in can feel like you are still exposed, and that anxiety is valid. But the good news is that session persistence is a known and controllable behavior. The real risk is leaving old sessions alive, especially on devices you do not control, because those sessions can continue to operate without knowing your new password, which is why you must actively revoke them and strengthen 2FA.
Here’s the metaphor: changing the password is like changing the lock on your front door 🏠🔑, but your previously issued house keys are not the only way someone can stay inside; if someone is already inside the house, the lock change doesn’t teleport them outside. A device session is like someone already inside. To restore security, you must also escort everyone out and lock the door again, meaning you log out of all sessions and re-authenticate only trusted devices.
How to Apply ✅🛠️
Step 1: Verify whether the old password truly works for a fresh login 🧪
This is the most important diagnostic. Do not test on a device that is already logged in. Instead:
- Open a private window (incognito) or a different browser profile where Facebook is logged out.
- Go to Facebook login page.
- Try logging in with the old password.
If the old password fails in a fresh login, your password change likely succeeded and the issue is session persistence. If the old password succeeds in a fresh login, treat it as a serious issue: repeat the password change, check for email changes, and assume compromise until proven otherwise.
Step 2: Force logout everywhere 🔥
Go to Facebook security settings and use the “Where you’re logged in” view to log out of all devices you do not recognize, or log out everywhere if you want a complete reset. This is how you kill alive sessions. After that, only log back in on devices you personally control.
Step 3: Change password again from a trusted device if there is any doubt 🔐
If you suspect compromise, change the password again from a device you trust, on a clean network, and make it unique. Avoid doing it from a device you suspect is infected or shared.
Step 4: Turn on two-factor authentication and generate backup codes ✅
Even if sessions are revoked, 2FA prevents a future attacker from logging in with just the password. Also generate backup codes and store them safely so you do not lock yourself out.
Step 5: Check for suspicious changes and linked logins 🧠
Look for changes to your email, phone number, and any linked accounts. Attackers often add a new email or phone so they can regain access. Also review connected apps and remove anything you do not trust.
Step 6: Clean up “trusted devices” and browser persistence 🧹
If a browser keeps you logged in because it’s set to remember sessions, consider clearing cookies on devices you do not fully trust. On phones, update the Facebook app and OS to reduce session anomalies and security issues.
Table 📊
| What you observed | What it usually means | Risk level | Best action |
|---|---|---|---|
| Old password works only on already logged-in device | Session token still alive | Medium | Log out of all sessions, re-login trusted devices |
| Old password works in fresh incognito login | Password change did not apply or compromise | High | Change password again, revoke sessions, secure email, enable 2FA |
| Device stays logged in after password change | Session persistence behavior | Medium | Use “Where you’re logged in” to terminate sessions |
| New password works, old also works on some devices | Old device session still valid | Medium | Logout everywhere, then test fresh login |
| You see unknown devices in sessions list | Possible compromise | High | Logout everywhere immediately, secure email, 2FA, review changes |
Diagram 🧩
Login with password once
|
v
Facebook issues session token to device
|
v
Device stays logged in using token
|
v
Password changes
|
+--> Token may remain valid until revoked or expired -> device still "works" 😵💫
|
v
Fix: terminate sessions + re-authenticate trusted devices ✅
Examples 😄
Example 1: Old password “works” only on your phone
Your phone app stays logged in and you assume it used the old password, but it actually used a session token. You log out of all sessions, reopen the app, and it forces you to login with the new password. That confirms it was session persistence.
Example 2: Old password works in incognito
You try incognito and old password still logs in. That is a serious signal. You should change password again, check your email for security alerts, and remove unknown sessions immediately.
Example 3: You changed password but a browser still loads your feed
The browser has a persistent cookie. Logging out of sessions kills it. If it still persists, clearing browser cookies forces a clean login.
Anecdote ☕😂
I have seen people panic because “old password still works,” but they tested it by opening the Facebook app that was already logged in, so the app never asked for a password at all. Once they did the incognito test, it became clear the old password was rejected and the only problem was that one device session was still alive. After logging out of all sessions, the stress dropped instantly because they finally felt the password change actually mattered 😅💛.
Personal Experience 🙂
When I need certainty, I never trust tests on a logged-in device. I always do the private window login test first, then I revoke sessions, then I enable 2FA, and only then do I relax. That sequence gives you a clear yes/no answer and closes the loophole where sessions stay alive even after password changes.
Emotional Connection 💛
After a scary security event, your brain wants a clean reset. Seeing old credentials appear to still “work” feels like you are still vulnerable. The good news is that in most cases it is not the old password working, it is the old session still alive, and you can kill sessions and regain control. Once you do, the feeling of safety returns quickly because you have removed the silent access path. 😌✅
10 Niche FAQs 🤓✅
1) Why does Facebook keep me logged in after password change?
Because session tokens can persist until revoked or expired, so devices stay authenticated without re-entering the password.
2) Does changing password automatically log out all devices?
Not always. You should manually log out of all sessions for a complete reset.
3) How can I prove old password truly doesn’t work?
Test it in an incognito window where you are fully logged out.
4) Can an attacker stay logged in without my new password?
Yes, if they have an active session token, which is why logging out of all sessions is essential.
5) What if unknown devices keep reappearing?
Treat it as compromise: secure your email, enable 2FA, review linked apps, and check for added emails or phones.
6) Should I change my email password too?
Yes, because email is the recovery channel, and attackers often target it.
7) Do I need to remove saved devices?
Yes, remove devices you do not recognize and revoke their sessions.
8) Can cookies make it look like I’m still logged in?
Yes, browser cookies store session tokens; clearing cookies forces re-authentication.
9) What should I do right after takeover recovery?
Change password, logout all sessions, enable 2FA, generate backup codes, and review contact details.
10) Why does it feel inconsistent across devices?
Because each device has its own session token and expiration behavior, so some will be forced to re-login sooner than others.
People Also Asked 🔎🙂
1) Is this a Facebook bug?
Usually no. It is normal session persistence unless the old password works in a fresh login test.
2) Does 2FA stop active sessions?
2FA mainly blocks new logins, not existing sessions, so you still must revoke sessions manually.
3) Can I force a logout on all devices?
Yes, use the security settings session management controls.
4) Why does one phone stay logged in for weeks?
Because some sessions persist long if not revoked, especially on trusted devices.
5) What is the fastest way to feel safe again?
Incognito test old password, then log out of all sessions and enable 2FA immediately.