If you use the default directory-based session backend (the kind you set via setPath), you could get a ceiling value for the number of active sessions by counting the number of session files in that directory. PHP doesn't guarantee that the folder is cleaned up on time, though, and this includes sessions that are still open but not currently in use (e.g. persistence sessions by "Remember Me" login features, and sessions with no active user but still active).