Four sources between them surface almost everything: your password manager, a search of your own mail archive, breach-notification records, and your sign-in-with providers. Most people find three to five times more accounts than they expected. The point isn't tidiness — it's knowing what depends on your address before you change anything, and closing the ones you've finished with.
Method 1 — Your password manager
Start here; it's the highest-yield source and takes a minute. Export or scan the vault: every saved login is an account, and most managers record which email address you used.
Limitation: it only knows what you saved. Accounts created before you started using it, or ones where you declined to save, are missing.
Method 2 — Search your own archive
Your inbox is a record of every service that has ever emailed you. Search your mail — including archived and deleted folders — for phrases that appear in signup and account mail:
"welcome to""verify your email"/"confirm your email""your account""password reset""thanks for signing up""your order"/"your receipt"unsubscribe— broad, but it catches every marketing sender
This is the method that surfaces the forgotten ones: the competition you entered in 2019, the wifi portal, the shop you used once.
Method 3 — Breach records
A breach-notification service lists known breaches containing your address, and each one names a company you had an account with. It's an imperfect list — it only covers breaches that became public — but every entry is a confirmed account. How to read the results
Method 4 — Sign-in-with providers
Check the third-party access lists in your Google, Apple, Microsoft and Facebook accounts. Each shows every site you've used social sign-in with — accounts that often don't appear in a password manager because there was never a password.
Worth doing for a second reason: it shows what data those apps can still read, and revoking access you no longer need is quick.
What to do with the list
- Close what you're finished with. The most effective single step — an account that doesn't exist can't be breached, sold, or acquired by someone with different marketing plans. Look for "delete account" in settings; in the EU/UK you have a right to erasure you can invoke if it's hidden.
- Change reused passwords. The audit will surface these, and it's the item with real security consequence.
- Move the important ones to their own address. Bank, government, utilities, insurance, anything financial.
- Leave the long tail. Don't migrate everything; let it move opportunistically as services email you.
- Keep the list. You'll want it if you ever do change address, and it's tedious to rebuild.
Most people guess forty or fifty accounts and find two hundred or more. That gap is the useful output of the exercise: it explains the spam volume, and it's why "just change my email address" is a much bigger project than it sounds. Whether that's worth it
Doing it once, then never again
The reason this audit is painful is that a single address gives you no record of who has it. Per-service addresses invert that: the list of your aliases is the list of your accounts, maintained automatically as a side effect of signing up.
That's a quiet benefit that only shows up later, and it's one of the better arguments for readable naming — ikea@yourdomain.com is self-documenting in a way x7fq2k@ never is. Naming conventions
More: the 30-day plan · the checklist