A secure online identity depends on more than a strong password. Use this reusable digital identity security checklist to audit account access, devices, recovery methods, active sessions, connected applications, and public profile exposure before small gaps become difficult problems.
Overview
Digital identity security is the practice of controlling how you sign in, what devices and services can act for you, how accounts are recovered, and what information is exposed through your profiles. The goal is not to eliminate every possible risk. It is to make access deliberate, recoverable, and easy to review.
This checklist works for personal accounts, professional profiles, developer services, and cloud platforms. Start with the accounts that would cause the greatest disruption if compromised: your primary email, identity provider, password manager, financial services, work accounts, code repositories, domain registrar, and cloud administration consoles.
Work through the audit in this order:
- Identify your most important accounts and the data or services they control.
- Strengthen sign-in methods, prioritising unique passwords, passkeys, or appropriately configured multi-factor authentication.
- Review recovery options, active sessions, devices, and connected applications.
- Reduce unnecessary public information and remove access you no longer recognise or need.
- Record what you changed and set a date for the next review.
For a broader starting point, see this guide to protecting your digital identity. The checklist below focuses on the audit process and the decisions that are easiest to overlook.
Checklist by scenario
When reviewing a high-value account
- Confirm the account uses a unique password stored in a reputable password manager, or uses a passkey where the service supports one.
- Check that multi-factor authentication is enabled. Prefer a method that remains practical during travel, device replacement, or loss of mobile service.
- Generate new recovery codes if they may have been viewed, copied, or stored in an unprotected location. Keep them somewhere separate from the device used to sign in.
- Review the account email address and phone number. Remove old contact details and confirm that the current details are controlled by you.
- Inspect recent sign-ins, recognised devices, and active sessions. Sign out of devices or locations you cannot identify.
- Review security notifications and account activity for changes you did not make, including password resets, new authentication methods, and profile edits.
When changing devices or moving to a new workflow
- Update the operating system, browser, password manager, and authentication applications before transferring sensitive access.
- Move passkeys and authenticator data only through the provider’s documented process. Do not place secrets in ordinary notes, screenshots, or unencrypted files.
- Remove the old device from account security pages after confirming that the new device works.
- Before selling, recycling, or returning a device, sign out, remove accounts, revoke sessions, and complete the manufacturer’s secure reset process.
- Review browser extensions and installed applications. Uninstall tools that are no longer required or that request broader access than their purpose suggests.
When auditing work, developer, or cloud accounts
- List administrators, owners, service accounts, API keys, deploy keys, and personal access tokens.
- Remove former users and reduce permissions that exceed current responsibilities.
- Set expiry dates or rotation reminders for credentials that cannot be replaced immediately.
- Review OAuth and single sign-on connections. Revoke integrations that are unused, duplicated, or no longer maintained.
- Check session duration, refresh-token handling, and sign-out behaviour in applications you manage. The session management guide provides a useful developer-focused review framework.
- Never paste a live token, private key, password, or recovery code into a public decoder, issue tracker, chat, or support request. A JWT decoder can help inspect non-sensitive test data, but decoding is not the same as validating a token.
When reviewing public profiles and online personas
- Search for old profiles, exposed contact details, duplicated usernames, and public documents that reveal more than intended.
- Use a consistent professional identity where appropriate, but avoid publishing information that could help someone guess recovery answers, workplace routines, or personal relationships.
- Check avatar, biography, profile links, and QR codes for accuracy before sharing them. A public profile should direct people to an official destination without exposing private account details.
- Review who can discover, message, tag, or download information from each profile.
- For guidance on balancing credibility and exposure, read these professional online persona and verification practices.
What to double-check
Some settings look secure at first glance but deserve a second review.
- Recovery is part of authentication. An account with strong MFA can still be weakened by an old recovery email, an unattended phone number, or support answers that are easy to discover. Verify every recovery route, not only the primary sign-in method.
- Device lists are not always session lists. Removing a remembered device may not terminate every active browser session. Use both device management and sign-out controls when available.
- Connected applications can retain access. Changing a password does not necessarily remove OAuth grants, API keys, or application sessions. Review each access path separately.
- Backups may contain identity data. Check whether password vault exports, authenticator backups, identity documents, browser profiles, or recovery codes are stored in shared folders or synchronised to devices you no longer control.
- Tokens reveal information even when they are not secrets. The claims in a token may contain usernames, roles, audiences, issuers, or expiration data. Treat copied tokens as sensitive, and use synthetic or redacted values for troubleshooting.
- Public information can support targeted attacks. A trusted online persona should be consistent without making every personal detail searchable. Separate information intended for networking from information needed only for account recovery or administration.
Common mistakes
- Reusing a password for convenience: one exposed service can create a problem across several accounts. Use unique credentials, especially for email and identity-provider accounts.
- Using one recovery channel for everything: if your primary email is unavailable, you may lose access to every account that depends on it. Maintain a documented, tested recovery path.
- Keeping old authenticators active: an old phone or authenticator app may remain trusted after a migration. Remove it once replacement access is confirmed.
- Ignoring dormant accounts: unused accounts can still contain personal data or provide a route to an old username. Close them where practical, or secure and monitor them.
- Confusing a security alert with a confirmed compromise: investigate calmly. Check the affected service directly rather than clicking an alert link, then change credentials and revoke access when evidence warrants it.
- Documenting secrets in the checklist itself: record that a control was reviewed, not the password, token, recovery code, or private key used by that control.
When to revisit
Make this audit a repeatable habit rather than a one-time project. A practical baseline is to review high-value accounts before seasonal planning cycles, major travel, device changes, or important work transitions. Repeat the review whenever your workflows or tools change.
Run a focused review immediately after a suspected phishing attempt, lost device, unexpected security alert, password-manager change, role change, or departure from a team. If an application, cloud provider, identity platform, or authentication method changes, reassess the connected sessions, recovery options, integrations, and permissions that depend on it.
To finish today’s audit, choose your five highest-impact accounts and complete these actions:
- Confirm a unique sign-in method and working MFA or passkey.
- Replace outdated recovery contacts and securely store recovery codes.
- Sign out unknown sessions and remove old devices.
- Revoke unused applications, keys, and tokens.
- Write down the review date and the next trigger that will bring it forward.
Use the same framework whenever you add a new account or adopt a new identity workflow. Consistent reviews make online profile security and identity management best practices easier to maintain as your digital life changes.
