---
title: "Let a remembered device skip only the · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/remembered-device
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Let a remembered device skip only the second factor

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Second factors and recovery](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- Level: Recommended
- Chapter: [Second factors and recovery](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery)
- Rule: A "remember this device" choice may skip the second factor at sign-in for at most 30 days. It never skips the first factor, admin sign-in or the check before a sensitive change.
- Applies when: The project has user accounts.
- How: NIST SP 800-63B-4 says "remember my browser" cookies shall not be used instead of authentication. OWASP treats them as a risk signal, never a replacement. So the person still proves the first factor each time. Thirty days matches the longest overall time-out NIST suggests for a single-factor session. Store a random token per user and device, kept as a hash, as [lock down session cookies](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/session-cookies) builds session IDs. Mark a sign-in that used it as single-factor. Then [ask again before changing how someone logs in](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/reauthenticate-sensitive-changes) still asks for the second factor. Show remembered devices in the [session list](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/session-list). Forget them all when the password changes, a factor is removed or someone reports "This wasn't me".
- Check: Sign in with the box ticked, sign out and sign in again. The password is asked and the code is not. Change the email, and the code is asked. Move a fake clock 31 days, and the code is asked again. A test admin is always asked.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const REMEMBER_DAYS = 30;
const DAY_MS = 24 * 60 * 60 * 1000;

export async function mustAskSecondFactor(db, user, rememberToken) {
  if (user.isAdmin || !rememberToken) return true;
  const device = await db.rememberedDevices.findByHash(user.id, sha256(rememberToken));
  return !device || Date.now() - device.createdAt > REMEMBER_DAYS * DAY_MS;
}
```

### Python example

```python
REMEMBER_FOR = timedelta(days=30)

def must_ask_second_factor(db, user, remember_token: str | None) -> bool:
    if user.is_admin or not remember_token:
        return True
    device = db.remembered_devices.find_by_hash(user.id, sha256(remember_token))
    return device is None or datetime.now(UTC) - device.created_at > REMEMBER_FOR
```

## Sources

- [NIST SP 800-63B-4 on browser cookies](https://pages.nist.gov/800-63-4/sp800-63b.html#sesscookies)
- [NIST SP 800-63B-4 on AAL1 reauthentication](https://pages.nist.gov/800-63-4/sp800-63b.html#aal1reauth)
- [OWASP Authentication Cheat Sheet on risk-based authentication](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#adaptive-or-risk-based-authentication)

## Related rules

- [Lock down session cookies](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/session-cookies) in Security testing
- [Ask again before changing how someone logs in](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/reauthenticate-sensitive-changes) in Security testing
- [List every signed-in device](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/session-list) in Accounts

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/remembered-device">Agent Wranglers accounts playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Tell people when their password worked but the second factor failed](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/failed-second-factor)
- [Second factors and recovery](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery)