Can I find all the accounts linked to my email address for free, without the password?

• Free, yes. Complete, no. Nothing below costs money, the first three steps need no password, and nothing is exhaustive. The limit is structural, not a paywall.
• Every “find all your accounts” product runs the same public checks. FootprintIQ's own pricing page lists “breach exposure indicators” and “limited platform detection” for its free scan: a breach lookup and an existence probe, stated plainly.
• The high-yield half needs you signed in. Saved passwords and the connected-apps lists at Google, Apple and Microsoft find accounts nothing external can.
• None of this is shady. A breach lookup reads already-published data. For scale, the Office of the Australian Information Commissioner recorded 1,205 breach notifications in 2025, up 8% on 1,112 in 2024.

Search the address at Have I Been Pwned: 17,847,746,941 addresses across 1,049 breached sites, and its FAQ says searches are not logged. Every named breach held your address at the time, so list the unfamiliar ones. Add free alerts at Mozilla Monitor, which says it has helped 10 million people in 237 countries since 2018, and now covers 20 addresses each. It is the same corpus, so treat it as monitoring, not a second opinion.

This is the mechanic every scanner sells and none explains. Login forms hide whether an address is registered; sign-up and password-reset forms often cannot, because “an account already exists for this email” is an answer. Open-source tools such as holehe automate that across 120-plus services. Most large platforms have closed the gap, so read a nil result as no information, not absence.

Put the full address in double quotes in Google and Bing. That catches public profiles, mailing-list archives, committee minutes and addresses committed into public code, none of which any breach index covers. Repeat for old addresses.

In your Google Account open Security, then Third-party apps & services, then See all connections, then repeat for Sign in with Apple and Microsoft. Open saved passwords in your browser or password manager and run its checkup view. Our guide on how to find accounts linked to your email walks through each provider's page.

Start the provider's account-recovery flow. Anyone offering to retrieve a password or read an inbox you cannot access is selling a scam or a crime. If an account has been taken over, call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371) and report through ReportCyber.

• Withdrawn breaches. Have I Been Pwned lists exactly two retired breaches: Ticketek and VTech. Ticketek's May 2024 incident, almost 30 million rows and 17.6 million unique addresses, later linked to the Snowflake compromises, is no longer searchable. Millions of Australians were in it, and a search no longer names Ticketek for any of them.
• Sensitive breaches: 90, hidden from public search until you verify control of the address.
• Accounts that never emailed you and never leaked, such as a dormant retailer login with a saved card.
• Your other addresses. Plus-aliasing barely helps: about 0.03% of Have I Been Pwned addresses use it.

The OAIC published 2025's figures on 6 July 2026: 1,205 notifications, the highest since the Notifiable Data Breaches scheme commenced in 2018, 716 of them malicious or criminal attacks. Health providers led on 225 (19%), then financial services (157), the Australian Government (118), business and professional associations (103), and education and legal, accounting and management services (81 each). The 2026 Australian Community Attitudes to Privacy Survey put data breaches top of Australians' privacy concerns at 82%, up from 74% in 2023.

One local rule limits what any search returns. Most businesses turning over A$3 million or less are not covered by the Privacy Act 1988, so a small Australian service that leaks your address may never have to tell anyone, and will never reach a breach index. The government has agreed in principle to remove that exemption, but no date is in law yet. The 10 December 2026 date some sites quote is for different changes, such as privacy policies describing automated decisions.

One Australian account deserves its own check: myGov. If you created it with this email, the email can also work as your sign-in name. Sign in, open your linked services, and confirm every one (ATO, Medicare, Centrelink) is one you linked yourself. myGov's own security advice is to turn off your email address and mobile number as usernames and sign in with your myGov generated username instead. Then a leaked email alone is not a myGov sign-in.