I Audited Every Online Account I Own. Here's What I Found (And Why You Should Do It Too)

Somewhere out there, there's a version of me on a MySpace page I haven't logged into since 2007.

There's also a me on an old fitness app I downloaded during a January motivation spike, a me on a flash-sale shopping site I used exactly once, and a me on a forum for a hobby I no longer have. All of those accounts still exist. They all have my email address. Several of them probably have an old password I still use for other things.

I know this because I spent the better part of last month doing something I'd been putting off for years: a full audit of my digital footprint.

The results were equal parts fascinating and unsettling. And I think every American with more than five years of internet history owes themselves the same exercise.

Why Most of Us Are Sitting on a Security Time Bomb

Here's the thing about dormant accounts: you may have forgotten about them, but hackers haven't. Data breaches happen constantly — in 2023 alone, hundreds of millions of Americans had personal information exposed through compromised databases. When an old account gets swept up in one of those breaches, the exposed credentials (your email and an old password) often end up on the dark web, where they're tested against banking sites, email providers, and everywhere else.

This is called credential stuffing, and it works disturbingly well — precisely because so many people reuse passwords across accounts they've long since stopped thinking about.

The fewer accounts you have floating around out there, the smaller your attack surface. That's the whole argument for doing this audit. It's not about paranoia. It's about basic digital hygiene, the same way you'd shred old financial documents instead of tossing them in the recycling bin.

Before You Start: What You'll Need

This project doesn't require any special tech skills, but a few tools will make it dramatically easier:

• A password manager (Bitwarden is free and excellent; 1Password and Dashlane are strong paid options). This is where you'll store credentials as you find them — and where you'll generate strong, unique passwords to replace the weak ones.
• Access to your primary email inbox — ideally going back several years. This is your paper trail.
• A spreadsheet or notes app to track what you find, what you've done, and what still needs attention.
• About 30 minutes per week — more in the first week, less as you go.

Week One: The Discovery Phase

The goal this week is simple: find every account you have. Don't fix anything yet. Just make the list.

Search your email. Open your inbox and search for phrases like "welcome to," "verify your email," "confirm your account," and "you've successfully registered." You'll be amazed what comes up. Go back as far as your email history allows. Every result is a potential account.

Check your browser's saved passwords. Chrome, Safari, Firefox, and Edge all store passwords, and reviewing that list will surface accounts you'd completely forgotten. Export the list if you can — just make sure to store it securely.

Think in categories. Go through this mental checklist:

• Shopping (Amazon, eBay, Etsy, old flash-sale sites)
• Entertainment and streaming
• Social media (including platforms you no longer use)
• News sites and forums
• Financial tools (budgeting apps, old bank portals, investment platforms)
• Health and fitness apps
• Travel and loyalty programs
• Work tools from old jobs
• Gaming
• Cloud storage and file sharing

By the end of week one, you should have a rough master list. Mine had 94 accounts on it. I was genuinely shocked.

Week Two: Triage — Keep, Delete, or Secure

Now go through your list and sort every account into one of three buckets:

Keep and secure: Accounts you actively use or that contain valuable data (financial accounts, primary email, cloud storage, social media you're active on). These get strong unique passwords, 2FA enabled, and a review of privacy settings.

Delete: Accounts you no longer need and that don't hold important data. Prioritize deleting over just abandoning — an abandoned account is still a liability. Most sites have a "delete account" or "close account" option buried in settings. Use it.

Review later: Accounts where you're not sure — maybe an old photo-sharing site that might have pictures worth saving, or a loyalty program with points you haven't checked on. Flag these and come back.

For every account you decide to keep, this is the week to update the password. Use your password manager to generate something long and random — 16+ characters, completely unique to that site. If the site supports two-factor authentication, turn it on now.

Week Three: The Privacy Deep Dive

With your account list cleaned up and your credentials secured, week three is about data privacy — specifically, what information these companies have stored about you and what rights you have to limit or remove it.

Under various U.S. state laws (California's CCPA being the most prominent), you may have the right to request a copy of your data, ask that it be deleted, or opt out of it being sold to third parties. Even if you're not in California, many companies apply these policies broadly.

For your most-used accounts — Google, Meta, Apple, Amazon — go into your account settings and review:

• What data is being collected and stored
• What's being used for ad targeting
• Whether your data is being shared with third parties
• Your download/export options (it's worth downloading your data from platforms you plan to delete)

Also check data broker sites. Companies like Spokeo, WhitePages, and BeenVerified aggregate personal information about you and make it searchable. Many of them have opt-out forms. It's tedious, but services like DeleteMe can automate much of the removal process if you'd rather not do it manually.

Week Four: Build the Habits That Keep You Clean

The audit is only valuable if you don't end up back in the same situation two years from now. Week four is about putting systems in place.

Stop creating throwaway accounts. Before you sign up for any new service, ask: do I actually need this? Will I use it more than once? If the answer is no, consider using a temporary email alias (services like SimpleLogin or Apple's Hide My Email are great for this) so your real address doesn't end up on another list.

Set a recurring calendar reminder — quarterly works well — to do a mini-audit. Add any new accounts to your password manager, delete anything you've stopped using, and check Have I Been Pwned (haveibeenpwned.com) to see if any of your email addresses have shown up in recent breaches.

Revisit your privacy settings periodically. Platforms update their policies and settings regularly, and not always in users' favor. A quick annual review of your Google, Meta, and Apple privacy dashboards takes less than an hour and is genuinely worth doing.

What I Learned From Doing This

Honestly? The process was more empowering than stressful. Yes, I found things that concerned me — reused passwords on accounts I'd forgotten about, personal data sitting on platforms I hadn't touched in years, one account that had already been flagged in a breach. But finding those things meant I could fix them.

I ended the month with 94 accounts down to 41. Every remaining account has a unique password stored in my password manager, and 2FA is enabled on anything that matters. My email inbox is cleaner, my digital footprint is meaningfully smaller, and I genuinely feel more in control of my online life.

That's the whole point. At CyberLife Plan, we talk a lot about protecting your digital life — and sometimes the most powerful protection isn't a new app or a fancy security tool. Sometimes it's just knowing what you have, and deciding to take care of it.