Why Does Mastodon Say 'Your Login Is Currently Disabled' or Keep Logging Me Out?

Why does Mastodon keep logging me out or say my login is disabled? #

Because sign-in belongs to the server that hosts your account, and several different things on that server look alike from your side: the wrong login page, a session that ended, an account that is not confirmed or approved yet, or a login the server's moderators disabled. Each server runs its own sign-in, so the same symptom can have different causes on different servers.

Match the message to the cause #

The three italic texts are error messages listed in Mastodon's API documentation (as 403 responses), so you may meet them in an app. The other rows come from the Help Centre and the documentation (read 3 October 2026).

Sessions and the e-mail token #

Session limits and server changes #

Mastodon's configuration page, written for administrators, gives three details:

• By default one user can have at most 10 browser sessions, and administrators can change the limit (MAX_SESSION_ACTIVATIONS).
• By default a session stays valid for 1 year without activity (SESSION_RETENTION_PERIOD).
• If an administrator rotates the server's secret key, every active browser session stops working, and rotating the OTP secret does the same to two-factor authentication.

So everyone on a server can be signed out at once by a change on the server side, and one account opened in many browsers or profiles can reach the session limit. mastodon.social's privacy policy (the version published on the server, dated 7 October 2022) adds that all logged-in sessions can be reviewed and revoked in settings, and that at login the server records your IP address and the name of your browser application.

The e-mail token #

The release post for Mastodon 3.2 (2 August 2020) describes one check: if an account has no two-factor authentication, has been away for at least two weeks, and someone tries to log in from a previously unseen IP address, a token sent to the account's e-mail address is required. Release posts are snapshots, and your server may run another version, so follow whatever your server's e-mail asks. The same post recommends two-factor authentication and says any TOTP app works.

Because that check is tied to a previously unseen IP address, an account without two-factor authentication that you open from a new network after a break can meet it. Keep access to each account's mailbox and finish the check rather than abandoning the sign-in.

Step by step: get back in #

1. Write down the exact message and the address of your server, which is the domain part of your handle.
2. Open the login page of the server that hosts the account and sign in with your e-mail address and password.
3. If you forgot the password, choose Forgot your password? on that same page and use the e-mail address of the account. The Help Centre says a reset link is only sent when you start on the right server's login page.
4. If the account is unconfirmed, use the confirmation e-mail or Didn't receive a confirmation link?.
5. If the message says the login is disabled, find the e-mail your server sent about the decision and use its appeal option (next section).
6. If you lost your two-factor device, contact your server's administrators. The documentation lists a command that removes additional factors so login works with a password, and others that reset a password or update an e-mail address.
7. Once in, open your account settings: you can change the e-mail address, set a new password, revoke active sessions or authorised apps and turn on two-factor authentication.

If the login is disabled or the account is suspended #

The software documentation says a frozen account can no longer log in, though its profile and data stay intact, and that a suspended account is effectively deleted, with its data kept in the admin back end for 30 days before it is purged. Since version 3.5.0 the affected user is told by e-mail and gets an appeal page where one appeal can be sent within 20 days.

mastodon.social and mastodon.online follow their own Help Centre article (updated 7 August 2026): appeals, including appeals of rejected appeals, within 30 days; the team aims to process them within 5 business days; send them with the appeal button in the e-mail, in the app for in-app notifications, or to moderation@joinmastodon.org. For other help on those two servers the Help Centre points to staff@joinmastodon.org. Other servers set their own rules and contacts.

Do not open a new account to carry on after a decision. The Community Standards for mastodon.social and mastodon.online list ban evasion among things not allowed, and the Help Centre's moderation article says further steps may be taken to prevent it. Appeal instead.

What if it still fails #

• The server may be down. Then the account is fine and the server is the problem. Servers linked from joinmastodon.org commit to at least 3 months of warning before shutting down, which is also a reason to keep an export of your data, as the profiles guide explains.
• You work with several accounts. Keep each one in its own browser profile, so you always know which account and which mailbox you are dealing with. A private window is only a temporary session, as the comparison with VPNs and private browsing explains.
• Nothing here matches. Write to your server's administrators with the exact message, the time, and the e-mail address of the account.

Where ADSSPEED fits #

ADSSPEED is a desktop app for Windows and macOS that manages many browser profiles. Each profile keeps its own cookies, local data and browser settings, so accounts you manage can stay signed in side by side without signing each other out, and each Mastodon sign-in stays inside its own profile. Profiles can be opened, stopped and organised in bulk, a proxy can be set per profile, and profile data stays on your own computer. ADSSPEED is not affiliated with Mastodon, and it does not change what any server's moderators decide.