Why twenty minutes is a guess about a guess
An idle timeout lives in a configuration file on a machine no outsider can look at. The only way to approach it would be to sit still and time your own logout, which would describe one session on one day, and timing things is not something this site does.
Even that measurement would be dirty. A session can end because a timer expired, because the operator invalidated sessions after a restart, because a balancer moved you elsewhere, because a browser dropped a cookie, or because everyone was logged out deliberately during trouble. From a chair all five look the same. No observation separates the number from the noise.
So twenty is offered for what it is: the band these settings usually fall in, somewhere between a quarter of an hour and half an hour on sites that bother to set one. Anybody printing a precise figure for a market they cannot see inside is guessing without admitting it.
What the twenty minute assumption buys you
One habit, and the habit is worth more than the number ever was. Write anything long somewhere else. A dispute statement, an address, a careful message to a vendor: compose it in a plain text editor and paste it in. A timeout landing mid sentence costs you the sentence, and the rewrite is always worse than the original because it gets written in irritation.
It also reframes a logout that arrives at an awkward moment. Twenty minutes spent reading a long thread without clicking anything is a completely ordinary way to reach an idle limit. The site behaved correctly and nothing broke.
And it explains why a short session is a feature rather than an annoyance. A machine somebody walked away from is a common way an account gets used by the wrong person, and a timeout is the only defence that operates while nobody is there.
What people read into a logout that is not there
Usually they read a hijack. Being logged out is close to the opposite of one. A stolen session gets used rather than ended, and anybody holding your cookie has no reason at all to expire it.
Next comes the belief that the site is broken or the address was wrong. Neither follows from a login screen. A timeout produces the same screen a working site produces, because it is a working site. What follows next is worth watching though, since logging back in from memory is how people spend the five attempts they get.
The third reading is that scrolling and reading count as activity. Usually they do not. Idle means no request reached the server, and a page being read quietly sends nothing at all. People who felt busy the entire time are genuinely surprised to have been idle by the only definition that counts.
What moves the twenty minutes
The operator moves it invisibly. Timeouts get shortened during trouble and lengthened once the complaints pile up, and neither change is ever announced. Some designs run two clocks at once, a short idle one and a long absolute one, so a session ends after a fixed span no matter how active anybody was.
The definition of idle moves it as much as the setting does. A page that quietly polls in the background keeps a session alive while you touch nothing. A page that does not lets it die while you read. None of that is visible from your side, which is why the figure belongs with the other judged clock numbers rather than with anything counted.
Questions people ask
Can the real timeout be found out?
Not from outside, and not from here. A precise figure published for a market nobody can see inside is an estimate wearing the clothes of a fact.
Does a logout mean my draft is gone?
Usually, which is the whole argument for writing anything long in a text editor and pasting it in when it is finished.
Is a shorter timeout a bad sign?
No. It reads as an operator taking session theft seriously. The cost lands on people who write slowly, and that cost has an easy workaround.