Why are the entries important?
Imagine seeing a security-related notification or prompt about activity involving your Gmail or your Google Account. As part of checking what has happened, you should look for additional information that can help you understand the activity.
When the activity relates to your Gmail, one way to find out more is to click Details next to Last account activity. This opens the Activity Information window, where Gmail provides information about recent activity or access, particularly access related to your Gmail.
The Details link next to Last account activity at the bottom of the Gmail Inbox opens the Activity Information window.
You may visit this window while investigating a particular activity, or simply because you have decided to review your Gmail activity as part of your own periodic security checks. It is worth noting that this is a separate check from the Google Account Security Checkup. The Security Checkup takes you through a series of security-related checks as part of a single guided process, but it does not, as part of that process, direct you to review the Details information available through Last account activity in Gmail.
Once you open the window, however, you may find that the information is quite diverse and can include a considerable amount of technical detail. You may see entries such as Browser, POP3, Authorized Application, Mobile, or Unknown, without it being immediately obvious what each entry represents or how the information should be interpreted.
The Gmail Activity Information window showing recent activity entries and the information associated with them.
This is particularly worth understanding because the Activity Information window is not something most users encounter as a routine part of reviewing their Google Account security. Consequently, even someone who regularly checks their account security may find themselves looking at these entries without much context for interpreting them.
That is the purpose of this guide.
It explains the different types of entries you may encounter in the Activity Information window, what they generally represent, and—just as importantly—what they do not necessarily tell you. The aim is to provide the additional context you may need when reviewing this information, whether you arrived here because something caught your attention or simply as part of your own periodic security checks.
Gmail provides an official Help Center article, "Last account activity", which explains the information available through this feature and provides Google's guidance about activity that you do not recognize.
This guide is intended to complement, rather than replace, that Gmail Help Center article.
The Gmail Help Center provides Google's official product information and security guidance. This guide takes a more practical approach, focusing on the entries you may actually encounter and providing additional context to help you understand what you are seeing.
Before interpreting an entry
Before looking at the individual entries, there is an important point to keep in mind.
The information shown in the Activity Information window describes activity or access that Gmail has recorded. Depending on the type of activity, however, the information displayed may not identify the exact device, application, person, or action that produced the entry.
An entry that you do not immediately recognize therefore does not automatically mean that someone else has accessed your account.
At the same time, an unfamiliar entry should not simply be dismissed. If you cannot explain an activity, you should investigate it and consider the circumstances in which it was recorded.
In other words, unfamiliar and unauthorized are not necessarily the same thing.
Understanding that distinction is important when interpreting the entries described below.
Browser
A Browser entry indicates access to Gmail through a web browser.
This is the type of access you would normally expect when you open Gmail in a browser and use the Gmail web interface. Examples include Firefox, Chrome, Safari, and Microsoft Edge (Chromium).
Depending on the information displayed, the entry may also provide information about the browser being used.
A Browser entry in the Gmail Activity Information window.
A Browser entry, however, should not be interpreted as identifying a particular physical computer or the person using it. It tells you about the type of access Gmail recorded, rather than providing a complete description of who was using the browser.
If the date and time correspond to a time when you were using Gmail in a browser, the entry will generally have a straightforward explanation.
If they do not, you should look at the other information associated with the entry before deciding what it means.
POP3
A POP3 entry indicates access to Gmail using the POP (Post Office Protocol).
POP is a method used by mail applications (email clients) to retrieve messages from a Gmail account. Unlike accessing Gmail through a web browser, where you interact directly with the Gmail web interface, a POP connection allows another mail application or service to retrieve messages from your Gmail account.
Examples of email clients that can be configured to access Gmail using POP include Microsoft Outlook, Apple Mail, and Thunderbird.
For example, if you have configured an email client to retrieve messages from Gmail using POP, that activity can appear as a POP3 entry in the Activity Information window.
Gmail's Mail Fetcher feature can also be relevant when interpreting a POP3 entry. Mail Fetcher allows Gmail to retrieve messages from another mail account, rather than you accessing that other account directly through its own web interface.
Consequently, seeing a POP3 entry does not, by itself, mean that someone has installed an unfamiliar email client or is accessing your Gmail from an unknown computer.
If you use an email client or a Gmail feature that involves retrieving mail through POP, consider whether that could explain the entry.
You can also check the Forwarding and POP/IMAP tab in Gmail's settings for information that may help corroborate what you are seeing. In particular, check whether POP access has been enabled and whether the settings are consistent with the way you use Gmail. This can provide additional context when you are trying to determine whether a POP3 entry has an expected explanation.
A POP3 entry in the Gmail Activity Information window.
A POP3 entry associated with Gmail retrieving messages through POP3.
As with the other types of activity shown in this window, the date and time, IP address, and approximate location can provide additional information when you are trying to understand a particular POP3 entry. Those details should, however, be considered together rather than interpreted in isolation.
Authorized Application
An Authorized Application entry indicates activity associated with an application or program that has been authorized to access your Google Account, particularly Gmail.
This is different from simply signing in to Gmail through a web browser. An application or service may have been granted permission to interact with your Google Account, and activity associated with that authorization can be reflected in the Gmail Activity Information window.
The important point is that an Authorized Application entry does not, by itself, mean that an unknown third-party application has accessed your account.
You may have authorized the application yourself, possibly some time ago, and may no longer remember doing so. You may also have authorized an application or service for a particular purpose without realizing that activity associated with that authorization could subsequently appear in your Gmail activity information.
An Authorized Application entry associated with a mobile email application.
An Authorized Application entry associated with an IMAP mail client.
An Authorized Application entry associated with activity involving another Google service.
An Authorized Application entry associated with an external service retrieving messages from Gmail.
If you encounter an Authorized Application entry that you do not recognize, you should investigate the applications and services that have access to your Google Account. You can review the list of third-party apps and services with access to your Google Account—and the Google products they can access—on the "Third-party apps & services" page. The information there may help you corroborate whether an application or service you have previously authorized could provide an explanation for the activity shown in the Gmail Activity Information window.
However, the Activity Information entry by itself is not sufficient to identify the particular application involved, the exact action that took place, or whether the activity was authorized by you.
As with the other entries, consider the date and time, IP address, approximate location, and anything you were doing with your Google Account around that time. These details may help you put the entry into context.
Authorized Application ()
You may also encounter an entry displayed as:
Authorized Application ()
Note that the parentheses are empty.
This can be particularly confusing because the entry appears to identify an authorized application while providing no information between the parentheses.
There is, however, a useful observation that you can reproduce for yourself. An Authorized Application () entry can appear in connection with activity involving Security Checkup.
To reproduce this:
- Open Gmail and click Details next to Last account activity.
- This opens the Activity Information window.
- In the Activity Information window, click Visit Security Checkup for more details.
- Review or complete the relevant activity in Security Checkup.
- Return to the Activity Information window and look at the entries listed there.
- You may see an entry displayed as Authorized Application ().
- Selecting Show details does not necessarily provide any additional information inside the parentheses.
An Authorized Application () entry with the Show details option.
- The entry may subsequently disappear after a few minutes.
- Refreshing the relevant information can cause the Authorized Application () entry to appear again.
The Authorized Application () entry after its details have been hidden.
Being able to reproduce the entry in this way is significant because it shows that Authorized Application () does not, merely because the parentheses are empty, mean that an unidentified third-party application has gained access to the account.
It is important, however, not to take this observation too far. The fact that the entry can be reproduced in connection with Security Checkup does not mean that every Authorized Application () entry is caused by Security Checkup. A similar entry encountered under different circumstances should still be investigated rather than automatically attributed to Security Checkup.
If you encounter an Authorized Application () entry, consider the date and time and what you were doing with your Google Account around that time. You can also review the list of third-party apps and services with access to your Google Account on the "Third-party apps & services" page. The information there may help you corroborate or rule out a possible explanation for the entry.
The important distinction is between what can be observed and what can be concluded from that observation. The empty parentheses do not, by themselves, show which application was involved or that the activity was unauthorized.
The reproducible Security Checkup observation gives you one possible explanation for this otherwise puzzling entry, but it should be treated as an example of how the entry can occur—not as a universal explanation for every occurrence.
Mobile
A Mobile entry indicates activity associated with mobile access to Gmail.
This can include access from a mobile device, including access through a mobile browser.
A Mobile entry in the Gmail Activity Information window.
It is important to be careful when interpreting the location associated with mobile activity.
Your mobile carrier or Internet service provider may route traffic through infrastructure that is geographically distant from the device you are actually using. Consequently, an approximate location shown for a Mobile entry may be somewhere other than your actual physical location.
This means that an unfamiliar location does not automatically indicate that somebody else was using your Gmail.
When reviewing a Mobile entry, consider the date and time, the connection you were using, the carrier or service provider information, and the other information displayed in the Activity Information window.
Location information can be useful when investigating activity, but it should not necessarily be taken as showing the exact physical location of the device.
Unknown
When you see an entry marked Unknown, it can look unusual because it does not immediately tell you what type of activity Gmail has recorded.
You may naturally wonder why the entry is described as Unknown when other entries in the Activity Information window are more specific about the type of activity involved. You may also wonder whether an Unknown entry means that someone else has accessed your account.
Not necessarily.
The term Unknown describes how Gmail classified the activity. It does not, by itself, identify the person or device responsible for the activity, nor does it establish that the activity was unauthorized.
An Unknown entry can occur in circumstances where you are actively using Google services.
For example, when multiple Google Accounts are signed in within the same browser, activity involving one account can sometimes result in an Unknown entry being recorded in another account's Gmail Activity Information.
An Unknown entry in the Gmail Activity Information window.
This is useful to keep in mind because it shows that the mere presence of an Unknown entry does not necessarily mean that somebody else has accessed your account.
That does not mean that every Unknown entry should simply be ignored.
If you see an Unknown entry that you cannot explain, consider the date and time, the IP address and approximate location, what you were doing with your Google Accounts at the time, and whether other activity around the same time provides a possible explanation.
If the activity remains unexplained and you have reason to believe that somebody else may have access to your account, follow Google's recommended account-security procedures.
The appropriate response is therefore neither to assume that an Unknown entry is harmless nor to assume that it represents unauthorized access.
It is an entry that needs to be considered in context.
Looking at information as a whole
The individual entry type is only one part of the information available in the Activity Information window.
When trying to understand an entry, it is useful to consider several pieces of information together:
- Date and time — Did the activity occur when you were using Gmail or another Google service?
- Access type — Was it Browser, POP3, Authorized Application, Mobile, or Unknown?
- IP address — Does it correspond to a network or connection you recognize?
- Approximate location — Is the location reasonably consistent with the network or service you were using?
- Your own activity — Were you using another device, mail application, or Google service around that time?
- Other Google Accounts — Were you signed in to more than one Google Account in the same browser?
- Authorized applications and services — Have you previously granted access to an application or service that could account for the activity?
Looking at these details together is generally more useful than focusing on one word in the Activity Information window.
For example, an unfamiliar location may initially look concerning. If the activity occurred while you were using a mobile connection, however, the location may be explained by the way your carrier or Internet service routes traffic.
Similarly, an Unknown entry may look alarming until you consider what you were doing with multiple Google Accounts in the same browser at that time.
The Activity Information window should therefore be viewed as a collection of information that can help you investigate activity involving your Gmail, rather than as a simple “safe” or “unsafe” indicator.
When should you be concerned?
An unfamiliar entry deserves attention, but there is an important difference between investigating an entry and assuming that your account has been compromised.
If you can account for the activity after considering the date, time, access type, IP address, your devices, applications, and what you were doing at the time, the entry may have a perfectly ordinary explanation.
On the other hand, if you find activity that you genuinely cannot account for, particularly if there are other indications that somebody may have access to your account, you should take the situation seriously.
Google's official guidance should be followed in that situation. Depending on the circumstances, this can include changing your password and reviewing your account-security information.
It is also worth remembering that the Activity Information window is not intended to provide a complete forensic record of every action performed on a Google Account.
It is one source of information that can help you understand activity or access associated with Gmail.
In conclusion
The Gmail Activity Information window can be useful when you are investigating activity that has caught your attention, but it can also be useful as part of a routine review of your Gmail activity.
The different entries describe different types of activity or access, but they should not necessarily be interpreted on their own. A Browser entry can reflect access through a web browser, while POP3 can be associated with mail applications or Gmail's Mail Fetcher. An Authorized Application entry can relate to an application or program authorized to access your Google Account, while Authorized Application () can appear without identifying information inside the parentheses. Mobile activity can be affected by the way mobile networks route connections, and an Unknown entry does not necessarily mean that somebody else has accessed your account.
The information accompanying an entry—such as the date, time, IP address, approximate location, and the activity you were carrying out at the time—can provide additional context. In some cases, checking related information elsewhere in your Google Account can also help you corroborate a possible explanation.
The important point is not to treat an unfamiliar entry as either automatically harmless or automatically suspicious. Instead, consider the information available, look for a reasonable explanation, and investigate further when you cannot account for the activity.
Understanding both what these entries can tell you and what they cannot tell you can make the Gmail Activity Information window much more useful when you are trying to understand activity involving your Gmail.