Ever cleared your history, closed the browser, and still found yourself signed back into the same sites minutes later? That “magic” is usually a hidden session token stored as a cookie or site storage entry, not your saved password.
If you want to delete browser login tokens without nuking everything, the trick is to remove the right data in the right place, then stop your browser (or sync) from re-creating it behind your back. The steps below match current desktop builds in January 2026 (Firefox 147, Edge 145, and recent Chromium-based Chrome).
What “hidden login tokens” are, and why they survive normal cleanup
Most modern logins don’t work like “username + password every time.” After you sign in once, the site drops one or more tokens on your device so it can recognize you later. Common places they hide:
- Cookies: The classic session cookie or long-lived “remember me” cookie.
- Local Storage / Session Storage: Small key-value stores used by many web apps.
- IndexedDB: A database in the browser, often used by large apps for offline and session data.
- Service Workers and Cache Storage: Can keep app state and cached responses that make re-auth feel instant.
- Browser sync and account sign-in: Chrome and Edge can re-populate settings and sometimes sign-in state across devices.
- OS credential stores: Some enterprise sign-ins and extensions tie into Windows Credential Manager, macOS Keychain, or Linux keyrings.
Deleting passwords alone usually won’t fix it. A password lets you log in, but a token keeps you logged in.
Before you start, use a safe approach: target one site first. Only go “scorched earth” if you still get silent sign-ins.
Quick fix: clear tokens for one site (without wiping the whole browser)
This is the fastest way to kick a single account off a shared computer or stop a stubborn site from re-signing you in.
Chrome (per-site cookies and storage)
- Open Settings.
- Use the Search settings box and type site data.
- Open Site settings, then View permissions and data stored across sites (wording may vary slightly by build).
- Search for the domain (example:
example.com). - Select it and choose Delete.
If you prefer an external walkthrough for the per-site method, see this guide to clear cookies and site data for a specific site.
Microsoft Edge (same idea, different menus)
- Open Settings.
- Search for site data.
- Go to Cookies and site permissions, then Manage and delete cookies and site data.
- Open See all cookies and site data, find the domain, then Remove.
Firefox (Manage Data is your friend)
- Open Settings.
- Click Privacy & Security.
- In Cookies and Site Data, click Manage Data.
- Search the site, select it, then Remove Selected.
Mozilla’s step-by-step reference is clear if you want a second source for the same screen: Clear cookies and site data in Firefox.
After any per-site removal, completely close the browser, reopen it, and revisit the site. If you’re still signed in, it’s time for the deeper clean.
Deep-clean tokens you can’t see, then confirm they’re gone
Per-site deletion usually works, but some apps keep auth state in multiple storage areas. This method is more “surgical” than clearing all browsing data.
Chrome and Edge: use DevTools to clear storage for that domain
- Open the site in a normal tab.
- Right-click the page, choose Inspect.
- In DevTools, open the Application tab.
- In the left sidebar, look for Storage.
- Click Clear storage (or Storage), then use Clear site data for that origin.
- Still in Application, expand:
- Cookies, delete cookies for the site.
- Local Storage and Session Storage, remove keys tied to auth.
- IndexedDB and Cache Storage, delete site entries if present.
- Service Workers, unregister if the app uses one.
This catches the “extra” tokens that survive basic cookie clearing.
Firefox: clear site storage from Developer Tools
- Open the site.
- Open Developer Tools (menu or shortcut), then select the Storage panel.
- Expand Cookies, Local Storage, and IndexedDB for the site.
- Delete entries tied to sessions (or clear the site’s storage group).
How to verify you actually removed the token
Use at least two checks:
- Private window test: Open a Private/Incognito window and visit the site. You should be logged out there. If you’re logged in even in Private mode, you may be using a device-based passkey flow or an external SSO session.
- Restart test: Close all browser windows (not just the tab), reopen, and revisit.
- Storage check: Reopen DevTools and confirm cookies and storage entries didn’t reappear immediately after page load.
If the site logs you in again only after you sign into the browser profile, sync is often involved.
Stop silent re-sign-ins: the settings that re-create tokens
Deleting tokens is half the job. The other half is blocking the quiet “re-attachment” that happens from sync, extensions, or account sessions that are still valid.
Limit browser sign-in, sync, and auto sign-in
- Chrome: In Settings, search for sync and sign out or pause sync on shared machines. Also search for auto sign-in in password settings and disable it if you don’t want the browser to auto-complete login flows. For background on Chrome’s auto sign-in behavior, see block Chrome from signing you in automatically.
- Edge: In Settings, go to your Profile and turn off Sync (or sign out of the profile entirely). Also check password settings for auto sign-in toggles.
- Firefox: If you use Firefox Sync, sign out on devices you don’t control. Also review saved logins in the built-in manager (tokens aren’t passwords, but cleaning both can stop “instant re-auth” loops). Mozilla’s reference: remember, delete and edit logins in Firefox.
Revoke sessions from the account side (the step people skip)
If a site still trusts your device, it may re-issue a new token as soon as you load the login page. Go to the service’s Security page and revoke active sessions for that device (Google, Microsoft, Apple, GitHub, Slack, and most banks have this). Then repeat the per-site deletion.
Watch for extensions and “helper” apps
Password managers, shopping extensions, VPN browser add-ons, and corporate SSO tools can restore sessions or inject auth headers. Quick test: disable extensions temporarily, restart, then check if the problem stops.
Block third-party cookies, but don’t break everything
Silent sign-ins sometimes come from an identity provider setting cookies in a third-party context.
- In Chrome/Edge, open Settings and search third-party cookies. Consider blocking them, then add exceptions for sites that truly need cross-site sign-in.
- In Firefox, adjust Enhanced Tracking Protection if cross-site login flows keep reappearing.
Clear on exit for specific sites (targeted)
If one domain keeps re-authing, configure it to be cleared when you leave:
- Chromium browsers support “clear on close” patterns via site data settings and exceptions (varies by build).
- Firefox can clear cookies on exit with exceptions in Privacy & Security, but use it carefully if you rely on staying signed in elsewhere.
Last resort: new profile or reset (export first)
If you’ve tried everything and tokens keep coming back, your profile may be syncing state you don’t want.
- Export bookmarks, and confirm your passwords are stored where you expect (browser manager or a separate password manager).
- Then use the built-in reset:
- Chrome: Settings → Reset settings.
- Edge: Settings → Reset settings.
- Firefox:
about:support→ Refresh Firefox.
This is the cleanest way to flush stubborn state, but it’s the most disruptive, so save it for the end.
Conclusion
Hidden tokens are the sticky notes of the web, handy until they keep letting you back in when you don’t want it. Start with per-site deletion, confirm removal in storage tools, and then block the quiet sources that re-create sessions. Once you can reliably delete browser login tokens and keep them from returning, shared computers and sensitive accounts get much easier to control.
