Delete the Accounts You Forgot

You've signed up for more things than you remember. The forum from 2011, the app you tried once, the store that wanted an account to check out. You walked away; your data didn't. It's still sitting there with your name, email, maybe an address and an old password, waiting for the next breach.

Dormant accounts are pure risk with zero upside. Clearing them out shrinks your attack surface, and it's one of the few privacy wins that keeps paying off: data that no longer exists can't leak.

Fair warning: companies make this deliberately tedious. Persist.

1. Find them

Your password manager is the map. If you've used one for years, the list is already there. Many have built-in breach reports, such as Bitwarden's Data Breach Report, that flag which logins have shown up in leaks. Start with those.

Check the managers you didn't know you used. Browsers save passwords quietly: look in Firefox, Chrome or Edge settings, Google Password Manager on Android, and the Passwords app on Apple devices. Desktop systems keep their own too: Credential Manager on Windows, Passwords on macOS, GNOME Keyring (via Seahorse) or KDE Wallet on Linux.

Search your inbox. Nearly every sign-up sends a welcome or verification email. Search every address you've ever used:

subject:(welcome OR verify OR confirm OR "activate your account")

Check the breach lists. Have I Been Pwned shows which breached services had your email, which often surfaces accounts you'd forgotten entirely.

2. Get back in

You can't delete what you can't access. Use the saved password if you have it; otherwise use Forgot password. If the site says no account exists for that email, or no reset link ever arrives, try your other addresses. If you've lost access to the email itself, customer support is the last resort, with no guarantees. Some services have already pruned the account for you.

3. Scrub, then delete

Many services keep your old details on file even after "deletion". So before you close an account, overwrite what it holds: name, address, birthday, phone, bio. Replace the email with a throwaway alias from SimpleLogin, addy.io or Firefox Relay, which you can kill afterwards. Avoid temporary-inbox sites; those addresses can often be reclaimed by someone else.

Backups may still hold the old data. Overwriting is damage control, not a guarantee.

Exception: if you're relying on EU rights (below), don't falsify anything yet; you may need to prove who you are.

Then look up the service on JustDeleteMe, which lists direct deletion links and rates how hard each one is. Some sites have a button. Some make you email support. Some won't delete at all.

4. If you're in the EU / EEA

Article 17 of the GDPR gives you the right to erasure, and it applies to any company serving European users, wherever it's based. Read the privacy policy: sometimes Delete account only deactivates it, and real erasure means emailing the data protection officer or filling in a form. If a company ignores you, complain to your national data protection authority. You may even be owed compensation.

5. When deletion is impossible

Make the account useless to an attacker:

• falsify every field you can;
• set a random password at the maximum length the site allows;
• turn on two-factor authentication and any other security options.

Keep the login in your password manager and check in occasionally. Some data, like financial records, companies are legally required to keep regardless. That part is out of your hands.

6. Stop creating new ones

The easiest account to delete is the one you never made. Before signing up, ask: do I actually need this, or can I check out as a guest, read without logging in, or skip it? Anything you post may also be cached by others, like the Internet Archive, long after the account is gone.

Close the doors you're not using. Fewer copies of you, fewer places to leak from.