Alongside two-factor authentication and passkeys, Account → Security gained the parts that deal with access you already have, rather than access you might grant.
Active sessions
You can now see every browser signed in to your account — device, IP address, and when it signed in — and end any of them.
This closes a real gap. Changing your password has never ended sessions that were already signed in, and neither does turning on two-factor authentication. Both govern the next sign-in. So until now, someone who discovered their password had leaked could do everything we offered and still leave the other person signed in until the session expired on its own. Sign out everywhere else is the button that actually removes them.
Change your password without the email round-trip
Previously the only way to change a password was to ask for a reset link — that is, to lock yourself out of a password you knew perfectly well, in order to replace it. There is now a Change password form on the security page.
It offers to sign out every other session while it's at it, ticked by default, for the reason above.
Breached passwords are refused
New and changed passwords are checked against public breach corpora. If yours is rejected, it isn't because it's too short — it's because that exact password appears in a known breach dump, which makes it one of the first an attacker tries. In practice this nearly always means a password reused from a site that was breached some time ago.
The check is anonymised. Only a short partial fingerprint is used to query the dataset; your password never leaves our servers.
We'll tell you when something changes
You'll now get an email when two-factor authentication is turned on or off, recovery codes are reissued, your password changes, a sign-in method is added or removed, or trusted devices are revoked.
These matter most in the case nobody wants: someone with your password turning your second factor off. The email is what makes that visible while it is still fixable — if one arrives and it wasn't you, change your password and sign out every other session.
More detail in the account security guide.