How to Find Old Accounts You Forgot About

Why the accounts you forgot are the ones that hurt

Dormant accounts fail in two directions at once. On the security side, they were usually opened before you had a password manager, which means they share a password with something you still care about — and a decade-old forum with weak hashing is exactly the sort of site that ends up in a breach dump. Credential-stuffing attacks are built precisely on this: take a password leaked from a site you abandoned in 2013, and try it everywhere.

On the privacy side, an unmaintained public profile is a snapshot of you that you've stopped curating. Old bios routinely contain a school, a hometown, a birth year, a former employer or a phone number. Old photos are geotagged. Old posts are searchable. And because you reused the same handle, all of it is one search away from your current identity. Cleaning this up is the highest-value privacy hour most people never spend.

Method 1 — search your own handles

Start with what you can find from the outside, because that's what everyone else sees. Write down every username you have ever used, going back as far as you can remember — the one from your first email address, the gamertag, the one you used on the forum for a hobby you dropped, the variations with numbers on the end. Then check where each one is still registered.

This is the fastest way to surface accounts you had genuinely forgotten, because you're not relying on memory to produce the site name; you're getting the list handed to you. AliaScan runs a handle against 400+ platforms and links each public profile it finds, which for most people turns up several accounts they'd have never thought to look for. Whatever you use, do it for every handle, not just your current one.

• •List handles by era — school, first job, gaming, hobby — rather than trying to recall sites.
• •Include the local part of old email addresses; people reuse it as a handle constantly.
• •Search each handle in quotes on Google and Bing too, to catch forum posts and comment histories that have no profile page.

Method 2 — mine your own records

Your inbox and your browser already hold a near-complete registry of everywhere you've signed up. This method finds the accounts that a handle search can't, including ones with no public profile at all.

• •Search every email address you own for phrases like 'welcome to', 'verify your email', 'confirm your account', 'thanks for signing up' and 'your account has been created'. Search all mail, not just the inbox, and include archived and spam folders.
• •Export the saved-password list from every browser you've used and from your password manager. Chrome, Safari and Firefox all have an export or a viewable list in settings.
• •Check your single sign-on grants: at myaccount.google.com under Data and privacy, and at appleid.apple.com under Sign in with Apple. Both list every third-party app you signed into with that account — often dozens.
• •Run each of your email addresses through Have I Been Pwned. The list of breaches an address appears in doubles as a list of services you once registered with.
• •Scan bank, card and PayPal statements for small recurring charges. Forgotten subscriptions are both an account and a cost.
• •Request a Google Takeout or check your browser history archive for login pages you visited repeatedly years ago.

Method 3 — decide per account: delete, clean or keep

Now triage. For anything you'll never use again, deletion is the only fix that genuinely removes the public profile — deactivation usually hides it while keeping the data, and many platforms restore everything the moment you log in again. Look for the account deletion page rather than the settings menu; sites bury it deliberately, and a search for the site name plus 'delete account' usually finds the direct URL faster than clicking around.

Where deletion isn't offered, do it in the right order: scrub the content first, then strip the profile, then abandon it. Delete or edit old posts and photos, clear the bio, remove the profile picture, change the display name to something neutral, and switch the account's email to an address you control but don't use. If you're in the EU, UK, California or another jurisdiction with a right to erasure, you can email the site's privacy contact with a deletion request and they are obliged to respond.

Method 4 — stop the pattern from regrowing

Once you're clean, the maintenance is small but it has to be deliberate. The habit that created the problem was reusing one handle and one password across everything, so break both at the point of signup rather than trying to fix it later.

Use your password manager to generate the username as well as the password for anything you don't need to be findable on. Keep deliberately separate identities: a public handle you're happy to have indexed, a pseudonymous one for hobbies, and a throwaway for one-off signups — with no string overlap between them and a different email address behind each. Turn on two-factor authentication everywhere it's offered, and put a recurring reminder in your calendar to re-run this audit once a year. It takes ten minutes when it's a habit and an afternoon when it isn't.