diff --git a/src/ajax.php b/src/ajax.php
index acc445f..4fceba3 100644
--- a/src/ajax.php
+++ b/src/ajax.php
@@ -311,6 +311,7 @@ elseif(isset($_POST['login']))
 		session_regenerate_id(1);
 		$_SESSION['logged'] = 1;
 		$_SESSION['token'] = generateUUID();
+		$_SESSION['sign'] = idSignature(session_id(), Config::get('password'), defined('MTT_SALT') ? MTT_SALT : '');
 	}
 	jsonExit($t);
 }
@@ -319,6 +320,7 @@ elseif(isset($_POST['logout']))
 	check_token();
 	unset($_SESSION['logged']);
 	unset($_SESSION['token']);
+	unset($_SESSION['sign']);
 	$t = array('logged' => 0);
 	jsonExit($t);
 }
diff --git a/src/config-sample.php b/src/config-sample.php
index 812d753..e96efa5 100644
--- a/src/config-sample.php
+++ b/src/config-sample.php
@@ -20,3 +20,5 @@ define("MTT_DB_PREFIX", "");
 
 // set mysqli if needed
 define("MTT_DB_DRIVER", "");
+
+define("MTT_SALT", "Put random text here");
\ No newline at end of file
diff --git a/src/docker-config.php b/src/docker-config.php
index 150b9ec..ec074ab 100644
--- a/src/docker-config.php
+++ b/src/docker-config.php
@@ -15,3 +15,5 @@ else if (getenv('MTT_DB_TYPE') == 'sqlite') {
 	define("MTT_DB_TYPE", "sqlite");
 	define("MTT_DB_PREFIX", "");
 }
+
+define("MTT_SALT", "Random text");
\ No newline at end of file
diff --git a/src/includes/class.config.php b/src/includes/class.config.php
index 57bbf8d..519a227 100644
--- a/src/includes/class.config.php
+++ b/src/includes/class.config.php
@@ -2,7 +2,7 @@
 
 /*
 	This file is a part of myTinyTodo.
-	(C) Copyright 2021 Max Pozdeev <maxpozdeev@gmail.com>
+	(C) Copyright 2021-2022 Max Pozdeev <maxpozdeev@gmail.com>
 	Licensed under the GNU GPL version 2 or any later. See file COPYRIGHT for details.
 */
 
@@ -271,6 +271,7 @@ class Config
 		$a[] = self::prepareDbDefine("MTT_DB_NAME", self::get('db.name')) . "\n";
 		$a[] = self::prepareDbDefine("MTT_DB_PREFIX", self::get('db.prefix')) . "\n";
 		$a[] = self::prepareDbDefine("MTT_DB_DRIVER", self::get('db.driver')) . "\n";
+		$a[] = self::prepareDbDefine("MTT_SALT", defined('MTT_SALT') ? MTT_SALT : generateUUID()) . "\n";
 		return implode("\n", $a);
 	}
 
diff --git a/src/includes/common.php b/src/includes/common.php
index a753047..50123b6 100644
--- a/src/includes/common.php
+++ b/src/includes/common.php
@@ -161,4 +161,16 @@ function isPasswordEqualsToHash(string $p, string $hash): bool
 	return false;
 }
 
+function idSignature(string $id, string $key, string $salt): string
+{
+	$secret = $key.$salt;
+	return hash_hmac('sha256', $id, $secret);
+}
+
+function isSignatureOk(string $signature, string $id, string $key, string $salt): bool
+{
+	if ( hash_equals($signature, idSignature($id, $key, $salt)) ) return true;
+	return false;
+}
+
 ?>
\ No newline at end of file
diff --git a/src/init.php b/src/init.php
index 9d41a54..7ed3efd 100644
--- a/src/init.php
+++ b/src/init.php
@@ -116,8 +116,9 @@ function need_auth(): bool
 function is_logged(): bool
 {
 	if ( !need_auth() ) return true;
-	if ( isset($_SESSION['logged']) && $_SESSION['logged'] ) return true;
-	return false;
+	if ( !isset($_SESSION['logged']) || !isset($_SESSION['sign']) ) return false;
+	if ( !(int)$_SESSION['logged'] ) return false;
+	return isSignatureOk($_SESSION['sign'], session_id(), Config::get('password'), defined('MTT_SALT') ? MTT_SALT : '');
 }
 
 function is_readonly(): bool