EGREED ID Security Center — protect your account end to end
The complete EGREED ID security guide: password best practices, MFA, authenticator apps, security keys, passkeys, encryption, suspicious login detection, alerts, device verification, session monitoring, phishing protection and safe browsing.
On this page
Password best practices
- Use a unique passphrase of 16+ characters, generated by a password manager
- Never reuse an EGREED password on any other website
- Never share your password, even with EGREED staff — we never ask
- Change it immediately if you suspect exposure
- Prefer a passkey where available and skip the password entirely
Multi-factor authentication
Enable MFA on every account. Ranked strongest to weakest: passkeys and FIDO2 keys, push approval, authenticator app (TOTP), then SMS.
Authenticator apps
Scan the QR code in Security → MFA with Google Authenticator, Microsoft Authenticator, Authy, Aegis or 1Password, then confirm the six-digit code. Codes rotate every 30 seconds.
Security keys
Register a FIDO2 hardware key such as YubiKey, Titan or SoloKey. Register two keys and keep one in a safe place as a backup.
Passkeys
Passkeys bind your credential to your device and the egreedtech.org origin, making them immune to phishing sites and credential stuffing. Sync them through Apple, Google or your password manager.
Encryption
TLS 1.3 in transit, AES-256-GCM at rest, Argon2id password hashing, HSM-protected signing keys, and optional customer-managed keys on enterprise plans.
Suspicious login detection
A risk engine evaluates device, ASN, geography, impossible travel, credential-stuffing patterns and behavioural biometrics, then challenges, notifies or blocks.
Login alerts
Every new device, browser or country triggers an alert with a one-tap "This wasn't me" action that locks the account and forces a password reset.
Device verification
New devices must complete a verification challenge — email code, push approval or existing passkey — before they can be trusted.
Session monitoring
Review live sessions with IP, location, client and last activity. Terminate any session instantly, or use Sign out everywhere to revoke all tokens.
Phishing protection
- Always check the domain is exactly
id.egreedtech.org - EGREED never asks for passwords, MFA codes, backup codes or recovery keys
- Genuine EGREED email passes SPF, DKIM and DMARC from @egreedtech.org
- Use passkeys — they simply do not work on a fake domain
- Report suspicious messages to security@egreedtech.org
Scam prevention
- Ignore anyone promising free EGREED credits in exchange for login details
- Never approve an MFA prompt you did not initiate
- Never install remote-access software at the request of a caller
- Verify any 'EGREED support' contact through support.egreedtech.org first
- Beware of lookalike domains such as egreedtech.co or egreed-tech.org
Safe browsing tips
- Keep your browser and operating system updated
- Avoid signing in on shared or public computers; use a private window if unavoidable
- Sign out when finished on borrowed devices
- Use a reputable DNS or browser safe-browsing filter
- Lock your device with biometrics or a strong PIN
Security checklist
- Enable MFA and register a passkey
- Download and store backup codes offline
- Verify recovery email and recovery phone
- Review devices and remove anything unfamiliar
- Review connected apps and revoke unused ones
- Turn on all security alerts
- Review login history monthly
More EGREED ID documentation
- EGREED ID overview
- EGREED ID features
- Create an EGREED ID
- Sign in to EGREED ID
- EGREED ID account recovery
- Manage your devices
Related platforms: Authentication and SSO, Security, Account, EGREED AI, EGREED Cloud, EGREED Deploy.
Official links: id.egreedtech.org · egreedtech.org · EGREED FAQ hub · Contact support.
Frequently asked questions
Does EGREED ID work with password managers?
Yes. EGREED ID follows the WebAuthn and autofill standards and works with 1Password, Bitwarden, Apple Passwords, Google Password Manager and others.
What happens if my password appears in a data breach?
EGREED ID checks credentials against known breach corpora and forces a reset with a security alert if a match is found.
Can I reuse an old password?
No. EGREED ID keeps a hashed history of your recent passwords and blocks reuse.
What is multi-factor authentication (MFA)?
MFA requires a second proof of identity in addition to your password — an authenticator code, security key, passkey or push approval.
How do I enable MFA on EGREED ID?
Open Security → Multi-factor authentication, choose a method, follow the setup, then store your backup codes safely.
Which authenticator apps are supported?
Any TOTP app works, including Google Authenticator, Microsoft Authenticator, Authy, 1Password and Aegis.
Does EGREED ID support hardware security keys?
Yes. FIDO2 and U2F keys such as YubiKey, Titan and SoloKeys are supported for the strongest phishing-resistant protection.
What are backup codes?
Backup codes are ten single-use codes issued when you enable MFA. Each one can replace your second factor once if you lose your device.
What if I lose my MFA device?
Use a backup code, an alternate factor, or start identity verification with recovery contacts. Enterprise users can ask an administrator to reset MFA.
Is SMS MFA secure?
SMS is better than no MFA but is vulnerable to SIM swapping. We recommend passkeys, authenticator apps or hardware keys instead.
Can my organization require MFA?
Yes. Organization administrators can enforce MFA, restrict allowed methods and require phishing-resistant factors for privileged roles.
I forgot my password — what do I do?
Choose Forgot password on the sign-in page. We send a time-limited reset link to your verified email or a code to your recovery phone.