You delete old accounts you forgot about by finding them first: search your inbox for welcome and verification messages, audit the sites saved in your password manager, then work through each service's own deletion route. Old accounts matter because every dormant login is a stored password, an email address and often a real name that can leak in a breach you no longer watch for. This guide covers the search tricks, the audit, breach checkers and how to word a deletion request.
Why are forgotten accounts the real breach surface?
Most people picture a breach as a single dramatic event affecting one big site. In practice the risk accumulates quietly. A forum you joined in 2014, a shopping site you used once, a trial that needed a login: each one holds a record with your email address, a hashed or plain password, and whatever profile details you typed in. When that service is compromised years later, the data is still valid for attackers because you never changed anything.
The second problem is that dormant accounts are invisible. You will not notice a password reset email for a site you have not visited in five years, and you may not recognise the sender. Attackers know this. Credential stuffing, where leaked username and password pairs are replayed against other services, works precisely because people reuse passwords and forget where they have accounts.
There is a third, subtler issue: identity. Many old accounts hold your real name, date of birth or a postal address from a checkout form. That data can be used for impersonation or social engineering long after you stopped caring about the service. Deleting the account removes the record; leaving it means trusting a company's retention policy you have never read.
How do you find accounts you signed up for years ago?
Your email archive is the closest thing most people have to a list of every service they have ever signed up to. The trick is searching for the language platforms use at signup rather than for site names you have forgotten.
Try these searches in your mail provider, one at a time, and skim the results:
"verify your email"or"confirm your email"— the standard wording of a signup confirmation."welcome to"— onboarding emails sent immediately after registration."your account"— catches password changes, security alerts and policy updates."unsubscribe"— nearly every marketing email contains it, which surfaces services you engaged with."password reset"or"reset your password"— sometimes the only trace of an account you barely used."receipt"or"order confirmation"— shopping accounts often persist with payment details attached.
If your provider supports it, restrict the search to older date ranges. Accounts from before a certain year are the ones most likely to be dormant and least likely to have modern security features such as two-factor authentication. As you build the list, note the service, the email address you used, and whether you still want it.
One caveat: if you have historically used throwaway addresses for low-value signups, those accounts will not appear in your main inbox at all. That is one of the practical benefits of disposable inboxes — the junk never reaches your real mailbox — but it does mean your inbox search gives an incomplete picture. If you want to understand the trade-off, our guide to disposable email versus a regular account sets out which signups belong where.
Step two: audit your password manager
If you use a password manager, it already holds a list of every site where you saved a login. That list is usually more accurate than your memory and often more complete than your inbox.
- Open the full item list and sort by date modified or date created, oldest first.
- Flag anything you have not opened in a year or more.
- Check for duplicate entries for the same service — a sign that you registered twice with different addresses.
- Look for entries marked as compromised or reused if your manager offers a security audit feature.
- Export the list to a spreadsheet if you want to work through it methodically, then delete the export file when you are done.
Browser-based password stores work too, though they tend to be messier. Check the saved-logins list in each browser you use, including ones you have mostly abandoned. A login saved in a browser profile from 2018 is exactly the kind of thing this exercise is meant to catch.
For accounts you decide to keep, this is the moment to fix the password if it is reused anywhere else, and to add a second factor. Our explainer on SMS versus app versus passkey two-factor covers which option suits which kind of account.
Step three: check what has already leaked
Breach notification services let you search an email address against collections of leaked data. The well-known option is Have I Been Pwned, which lets you search an address and also subscribe to alerts for future breaches. Several password managers and security suites include similar checks built in.
What to do with the results:
- Change the password on any live account that appears in a breach, and change it everywhere else you reused it.
- Treat breached accounts as candidates for deletion if you no longer use the service. There is no reason to keep a login on a site that has already lost your data.
- Watch for follow-on phishing. Breach data fuels convincing emails that reference real details. Our piece on what to do after a data breach walks through the sequence.
Be honest about the limits. Breach checkers only know about leaks that have been discovered and published; plenty of incidents stay private or surface years later. A clean result means nothing has been reported, not that nothing has happened. Behaviour and reporting vary between services and change over time, so treat any single check as one signal among several.
Step four: delete the accounts, in the right order
Work from the least important accounts upward. Start with forums, newsletters and one-off shopping logins, and save anything tied to money, government services or your main identity for last, when you are paying full attention.
Most services bury deletion in account settings, often under a privacy or data section rather than a security one. Look for wording such as "close account", "delete account" or "deactivate". Deactivation and deletion are not the same thing: deactivation usually hides the profile while keeping the data, so read the confirmation screen carefully.
Before you pull the trigger on any account:
- Check for active subscriptions or stored payment methods, and cancel or remove them first.
- Download anything you want to keep — photos, documents, purchase histories, exported messages.
- Note any service where the account is your login for something else (a linked app, a single sign-on identity).
- Change the password to something random if deletion requires a confirmation email you might miss, so the account is useless in the meantime.
When a service has no self-service deletion, you have a legal lever in many jurisdictions. Under the UK GDPR and the EU GDPR you can make an erasure request, and California's CCPA gives residents a right to delete. Send the request from the address on the account, name the right you are relying on, and ask for written confirmation. Keep the reply. If nothing happens, a complaint to the relevant data protection authority is the next step.
Expect friction. Some services ask you to contact support, some require you to log in first, and some will simply ignore a first email. Persistence is normal here; it is not a sign you did something wrong.
What breaks, and when should you stop deleting?
Deletion is not always the right answer, and it is worth knowing where it goes wrong before you start.
- Recovery email addresses. If an old address is the recovery route for a current account, deleting it can lock you out. Check dependencies first.
- Purchases and licences. Software licences, e-book libraries and game stores often tie entitlements to the account. Deleting means losing them.
- Two-factor enrolment. If the account is your second factor for something else, removing it breaks that chain.
- Financial and legal records. Some accounts must be kept for tax or warranty reasons.
- Identity verification. Accounts that have passed ID checks may be harder to recreate later, which matters if you might return.
For accounts you want to keep but not expose, an email alias is often better than deletion: it lets you cut off contact without losing the login. Our comparison of temp mail, VPNs and aliases explains which tool solves which problem.
Stop the next wave of forgotten accounts
The reason people end up with dozens of dormant logins is that signups are frictionless and nobody plans for the cleanup. A few habits prevent the pile from rebuilding.
Use a disposable inbox for anything you will never need to log into again: download gates, one-off discount codes, forum lurks, trial signups. The address expires and the account becomes unreachable by design, which is a feature rather than a bug. If you are new to the idea, start with what a disposable email actually is, and keep in mind that a temporary address is receive-only and time-limited, so it is wrong for anything you need to recover later.
For accounts you genuinely need, use an alias you control so you can switch it off later without losing the login. And once a year, repeat the inbox search above. Fifteen minutes of searching beats discovering a five-year-old breach the hard way.
Sources
- California Attorney General — California Consumer Privacy Act
- Have I Been Pwned — check an email address against known breaches
- NIST — Digital Identity Guidelines (SP 800-63-4)
In short
Find forgotten accounts by searching your inbox for signup language and auditing your password manager, then check breach data to see which ones have already leaked. Delete from the bottom up, check for dependencies such as recovery addresses and subscriptions, and use a formal erasure request where self-service deletion does not exist. For future signups you will never need again, a disposable address keeps the account out of your real mailbox — and out of your future cleanup list.