Nothing lists every account tied to your email. No tool, no dashboard, no button. The only complete method is a four-source audit: inbox, saved passwords, connected apps, breach data. And the audit only pays off if each account you find gets its own alias. I run AliasFleet, an email-alias service built on exactly that rule: one address per site.
Think back over ten years of signups. Free trials. One-off shops. Forums you opened twice. Apps you deleted from your phone without ever closing the account behind them. Nobody kept a list. No registry exists, no site tells the next one you signed up, and no button prints the inventory. The audit below builds it in about an hour, from four sources you already have.
Why no tool can list them for you
Your email address is not a key. It does not unlock a central record. Each site keeps its own copy of your signup, and sites do not compare notes. So any service promising the full list in one click is guessing. Or selling a partial list dressed up as a complete one.
Breach checkers fall into the same trap. Have I Been Pwned is the best of them. It is still a list of breaches, not a list of accounts. An account reaches it only if its service was breached, somebody found the breach, and the data was loaded. Plenty of your accounts clear none of those bars. Treat HIBP as one source of four. Never the whole audit.
Start with the inbox: your signup receipts
Almost every signup leaves mail behind. Welcome messages. Verification links. Receipts. Password resets. Shipping notices. Win-back campaigns from services you forgot you joined. Taken together, your inbox is the nearest thing to a signup log you own. Gmail's search operators pull it out in bulk. Run these four searches, one at a time, and note every service that turns up:
subject:(welcome OR "verify your email" OR "confirm your email")
subject:("password reset" OR "reset your password")
subject:(receipt OR invoice OR subscription OR "order confirmation")
in:anywhere subject:(welcome OR verify)
That last search does the quiet work. Gmail leaves Spam and Trash out of a normal search, and old signup mail drifts into exactly those folders. The in:anywhere operator drags it back, and Google's own search guide confirms the exclusion it gets around. Sort oldest first if your mail app lets you. The oldest hits are the accounts you have forgotten hardest.
Two traps. First, run the searches for every address you have ever used, dead school addresses included. An account tied to an old address will not appear in your current inbox. Second, open the sent folder. If you once emailed a site's support team, that thread names an account the welcome-mail searches can miss.
Even then, the audit has blind spots. Phone-only signups leave no mail. Accounts under an address you forgot to search stay hidden. Welcome mail you deleted years ago is gone. The inbox is the biggest source. It is not a complete one.
Your saved passwords already hold a list
Open your password manager. Read the whole list, top to bottom. Each entry is an account. Most people skip this source. It is often the longest of the four, because it keeps accounts whose welcome mail you deleted long ago.
Google users find the list at Google Password Manager. On an iPhone, open Settings, then Passwords, then tap an entry to see it; Apple's own guide walks through the same steps. A standalone manager holds the same list in a different app. Check every manager you have used, and check the browser on each device you own. A login saved in Chrome on a laptop you no longer use is still a live account.
One warning from Apple holds everywhere. Deleting a saved password does not close the account. The account on the site stays live, with your data in it, until you delete it on the site itself. Read the password list as an inventory. Not a delete button.
And the list has holes. A manager only shows logins it saved. It misses accounts created without a saved password, social sign-ins that never stored one, and logins on other devices or browsers. That is why the audit needs four sources, not one.
Connected apps: the sign-ins you never closed
Third source. The apps and sites linked to your big accounts. These are the places where you clicked "Continue with Google", or handed an app access to your mail, calendar, or contacts, and then forgot about it. Some of them are accounts in their own right. All of them hold some access to your data.
For Google, open the connections page and read every entry. Anything you do not recognise, or no longer use, loses its access. Google's linked-apps help states the detail that makes this step matter: deleting your account on a third-party app does not notify Google, so the app can stay listed as linked after you believed you had closed it. Removing it from the linked-apps page is what actually revokes the access. Run the same review on any other account that holds sign-ins, such as Microsoft or Apple.
Breach data catches the stragglers
Now the breach check. Type your address into Have I Been Pwned and read the breach list as leads. Each breach name is a service that held your address. A name missing from your inventory, built from the first three sources, goes on the list. That is a forgotten account, confirmed by a third party.
Read the result with its limits in view. HIBP's own FAQ says searches are not logged, no passwords are loaded beside breach addresses, and the public search returns one address at a time. It also says 89 breaches are classed as sensitive and only appear to the verified owner, and that absence of evidence is not evidence of absence. A clean result means your address was not in the breaches HIBP has loaded. Nothing more.
Scale helps, and it still stops short. As of 14 October 2026 the homepage counter reads 1,045 breached sites and more than 17.8 billion addresses. Wide coverage. Not everything. If you want the full walkthrough of reading the result, our HIBP safety piece covers what the site keeps and what it does not.
Sort the list: close, keep, convert
You now hold a list. Probably a long one. Split every entry into three buckets, and work them in this order.
Close
Close the ones you do not use and do not need. Go to the site itself, type the address into your browser, sign in, and delete the account in its settings. Then delete the saved password. Closing is the only bucket that shrinks your exposure. It also takes longest per account, so begin with the ones holding payment details or identity documents.
Keep
Keep a small set: accounts that must stay, on the real address, behind a unique password and a second factor. Banking and government services. Anything you must reach reliably for years. If your keep bucket holds forty entries, most of them belong in the third bucket.
Convert
Convert everything else. These are accounts you keep using but do not need tied to your real address. Give each one its own alias going forward. If the account is breached or starts spamming you, the damage stops at that one address.
One rule about passwords while you triage. When you change a password, go to the site yourself and type the address in. Never change one by clicking a link in an email, even an email that looks like it came from the site. Breach follow-up phishing copies real notices, and the breach-response guide walks through the full order of operations. If you are weighing a fresh address instead, our piece on whether to change your email after a breach says usually not, with two exceptions.
The conversion that ends the audits
This is the payoff the audit builds toward. An email alias is a separate forwarding address that delivers to your real inbox. Give each site its own alias, and your alias list becomes the inventory you just spent an hour building by hand. No more audits. The list maintains itself. Every new signup adds one row, and every row names exactly one site.
The mechanism is simple. A site leaks or sells its copy. Spam or phishing lands on that site's alias. The To field names the source before you open the message. Pause the alias and the channel dies while your real inbox stays clean.
Our leak-tracing guide walks through that check in detail. The setup guide takes about two minutes per method. The use-cases guide covers where to point the first aliases. The one-alias-per-site piece covers the reasoning behind the whole system. The free tier covers 10 active aliases, enough for the accounts that matter most while the habit forms.
What aliases cannot undo
One limit, stated plainly. Aliases do not fix the address you have already handed out for a decade. Nothing does. The old address sits in old dumps and old databases, and no product reaches back in time to scrub it. What aliases do is stop the list growing. That is the part you still control. Your bank and your government accounts keep a stable address. Everything else gets an alias, starting with the accounts your audit just surfaced.
Run it once, then never again
Run the four sources, triage the list, convert the middle bucket. Then the next time a breach notice lands, you will not need an audit at all. You will read the breach name, check which alias that site held, and pause it. The full HIBP walkthrough covers the check itself if you want it. Do the audit once, properly, and make every signup after it carry an address you can kill.
Top comments (0)