If you think your PoolStamp account has been compromised (stolen phone, shared password, ex-employee you forgot to remove), you can rotate credentials and end every active session yourself.
Reset the password
From the web admin, Settings → Security → Change password. If you can't sign in, use the "Forgot password?" link on the login screen — you'll receive an email with a signed link, good for 60 minutes. Setting a new password does not automatically end other sessions.
Kill every active session
Settings → Security → Active sessions lists every device with a valid session token — the browser or mobile app, the last-used timestamp, and the device model. Two options:
- Revoke one — kills the token for a single session (useful for "I left my session logged in on my brother's laptop").
- Revoke all sessions — kills every session including the one you're using. You'll be signed out immediately and need to sign in fresh.
Choose Revoke all for anything that could be a real compromise. It's the belt-and-suspenders move: rotate password + kill sessions.
What happens under the hood
Sessions are validated per request against a server-side allowlist. Revoking flips that entry to revoked in the same second. Any request in flight from a revoked session gets a 401 on its next call, and the client is forced back to sign-in. There is no cached credential a revoked token can fall back to.
Reset an ex-employee's access
The current Team screen lists members and supports invites, but self-serve member removal is not exposed there yet. Revoke their sessions immediately, then contact support with the member email so the org membership can be removed server-side.
Password strength
PoolStamp enforces at least 8 characters. We recommend a longer passphrase (three unrelated words + a number, e.g. river-orange-guitar-42). Passwords are hashed with bcrypt at cost factor 12 by default — the plaintext is never stored.