How to find accounts linked to your email

Most accounts leave an email footprint: welcome messages, login codes, shipping receipts, invoices, password resets, renewal notices, privacy-policy updates and breach notifications. That means your inbox can act like a rough map of your accounts, even when your memory has politely moved on.

It is worth being clear about what you are reconstructing, because it changes how you search. There is no central register of the services holding your email address, and no single tool can produce one. What you can do is combine several partial views, each of which covers a gap the others leave. An account that never emailed you will not show up in your inbox, but it may appear in your saved passwords. An account you created with a social sign-in button may have sent you nothing at all, but it will be listed by the identity provider. A service you forgot entirely may only surface because it was breached.

That is the whole logic of the five methods below. They are ordered by yield: the first one finds the most, and each subsequent one exists to catch what the previous ones structurally cannot.

Your inbox is the highest-yield source, and search operators are what make it fast. Rather than scrolling years of mail, you search for the handful of phrases that almost every signup produces. Start with these terms:

Work through them one at a time and write down every distinct service name you see. Do not stop at the first page of results, and do not skip the promotional and spam folders, which is where old marketing mail from dormant accounts usually ends up.

Gmail

Google's search operators narrow messages by sender, subject, age and date range. from:noreply is the single most productive search, because automated senders are almost always transactional account mail. Pair it with older_than:1y to surface the dormant accounts specifically, and use subject: to target phrases, which catches most signup confirmations in one pass.

Outlook, Hotmail and Live

Outlook supports the same idea with slightly different syntax: Microsoft documents the search filters for narrowing by sender, subject, date and folder. Search from:noreply and from:no-reply separately, because Outlook treats them as different strings, and remember to include the Other inbox if you have Focused Inbox turned on, since transactional mail is frequently sorted there.

Apple Mail and iCloud

Apple Mail has no operator syntax as rich as Gmail's, so the practical approach is to search the plain phrases above and then sort by sender to group results. If you have used Hide My Email, check those addresses as well, because each one represents a separate service that has your relay address rather than your real one.

Yahoo

Yahoo Mail search accepts the same keyword phrases. Its more useful feature for this exercise is the account security page rather than the mailbox, which is covered in method 3 below.

Your browser or password manager already holds a list of logins you have saved, and it is the fastest win on this list. Reviewing it takes a few minutes and catches accounts that never sent you mail at all.

While you are there, open the health or checkup view. Chrome, Safari, Firefox and every major password manager will flag reused, weak and breached passwords. That matters here for a specific reason: a reused password turns one breached account into every account sharing it, so the reuse report tells you which of your newly discovered accounts to deal with first.

Add anything you find to your list even if you are certain you will keep the account. The point of this exercise is a complete picture, and deciding what to close comes later.

Every time you used a “Sign in with” button instead of creating a password, the identity provider recorded it. Those lists are the only reliable record of accounts that may never have emailed you and were never saved in a password manager, which makes this the method people most often skip and most often need.

• Google: connections to third-party apps and services lists every app you granted access to, and lets you remove it.
• Apple: apps using Sign in with Apple shows each app and lets you stop using Apple sign-in for it.
• Microsoft: the Recent activity page shows when and where your account has been used in the last 30 days, which surfaces services actively signing in as you.
• Yahoo: the account security page lists External connections, the third-party apps signed in to your account, and lets you remove them.

A breach check can reveal services you had forgotten you ever signed up to, and it is the one method that needs no login anywhere. Have I Been Pwned lets you check, for free, which known breaches your email appears in.

Read the results as an account list rather than a threat list. Every breached service named there is, by definition, a service that held your address at the time. If you do not recognise one, that is an account to add to your inventory and probably to close. If you want a second opinion, no breach corpus is complete, so our Have I Been Pwned alternatives guide covers the checkers worth running alongside it. See what to do if your email is in a data breach for the full response.

Pull the results of the methods above into a single list, a spreadsheet works fine to start. For each account, note the service, the email used, whether it holds payment or identity details, and whether you still need it.

Sort that list by what the account holds rather than by how old it is. An abandoned forum login with nothing but a username is a much smaller problem than a dormant retailer account with a saved card and a delivery address, even if the forum account is older. That inventory is the foundation for the digital footprint checklist and for deciding what to keep, secure or delete.

Once you can see the accounts, decide on each one. Close accounts you no longer use, especially those holding payment details, addresses or identity documents, because every dormant account is extra breach exposure. Our guide to deleting old accounts covers the Australian deletion rights worth citing when a service makes closing an account difficult.

For the accounts you keep, set a unique passphrase and turn on multi-factor authentication, starting with the ones the password reuse report flagged. Then check the recovery details, because an old phone number or a dead secondary address on an account you are keeping is its own quiet risk.

In The Event Of is built around turning inbox noise into an account map. You can connect a supported inbox (Gmail or Outlook) so it can scan for account-related metadata, sender addresses, subject lines, labels and timestamps, not the body of your emails, or add services manually. It then organises what it finds into a digital footprint, highlights breach exposure, and gives you guided steps to secure or update each account. You stay in control of every change.

It automates method 1 and method 4, which are the two slowest steps here, and it keeps the resulting inventory current instead of leaving you with a spreadsheet that goes stale the week after you build it. The Free tier is A$0 and does not require a credit card.