A forum you registered on in 2013 for a single question. A shop where you made one purchase. A service that closed long ago but handed its database to somebody. All of it exists and holds your data, and you do not remember any of it.
A tenth of them are in active use. The rest are forgotten sign-ups that still hold an email address, a phone number and sometimes a delivery address.
Why a forgotten account is a risk
- It will end up in a breach. Not necessarily tomorrow, but over ten years the odds are high. And if the password was reused, the breach reaches further than that one site.
- You will not hear about it. The notification goes to an address you probably do not check either.
- It holds stale data. An old phone number, now belonging to someone else, is a ready-made recovery route for a stranger.
- It can be a way in. “Sign in with” links accounts into a chain, and the weakest link drags the others along.
How to find what you forgot
-
The list from your manager or browser
The most complete source. Export the saved passwords — it will contain things you have forgotten entirely.
-
Search your email
Look for “welcome”, “confirm your registration”, “your account has been created”. That finds sign-ups the browser never recorded.
-
The “connected apps” section
Your social and mail account settings list every service you signed in to through them. The list is often surprising.
-
A breach lookup
A check shows whether your address has appeared anywhere — and reminds you of services you have not thought about in years.
What to do with what you find
| Kind of account | Decision | Why |
|---|---|---|
| Not needed, little data | Delete | No account, nothing to leak |
| Not needed, but there were purchases | Clear the data, then delete | Remove the address and card first: some services keep history after deletion |
| Needed occasionally | Keep, change the password | A unique password turns a future breach into a non-event |
| The service has closed | Change the password wherever it was reused | Deleting is no longer possible, but the leaked value can be made worthless |
| Not sure it is mine | Recover access and look | Someone else's account on your address is also worth understanding |
Where to start if time is short
- A hundred-odd sign-ups, half forgotten
- An old phone number in recovery contacts
- One password across dozens of sites
- You learn about a breach from the news
- The list is known, the excess deleted
- Recovery contacts actually work
- Unique passwords in a manager
- A breach concerns one service
Cleanup pairs well with a password audit: it needs the same list of accounts, and the work is done once.