Digital hygiene
Find all accounts linked to your email
Most people have well over a hundred online accounts and could name maybe twenty. The rest are a shop you ordered from once, a free trial, a forum, an app you tested for a week. They still hold your name, your address, sometimes a card number, and they keep existing long after you stop using them. You cannot close or secure an account you do not know about, so the first step is the inventory.
The good news: your inbox already has that inventory. Signing up almost always triggers an email, and so do password resets, new sign-ins, receipts and privacy policy updates. Find those emails and you find the accounts.
Method 1: search Gmail by hand
Paste each of these into the Gmail search bar and note every sender you see. It is free and works well for a first pass, but expect to spend an hour or two on an inbox that is several years old.
subject:("welcome to" OR "thanks for signing up" OR "confirm your email")finds sign-ups.subject:("verify your email" OR "activate your account" OR "account created")catches the rest of them.subject:("password reset" OR "new sign-in" OR "security alert")finds accounts you actually logged in to.subject:("privacy policy" OR "terms of service") older_than:1ysurfaces services you forgot, because they still email you about their legal updates.subject:("receipt" OR "invoice" OR "renewal")finds the accounts that bill you.
The limits of doing it by hand: the same company writes from several addresses, the results are not deduplicated, and nothing tells you which accounts are dormant or which ones reported a breach.
Method 2: let HealthInbox build the list
HealthInbox is a Chrome extension that runs those searches for you and keeps the result. It reads the headers of your Gmail messages (sender, subject, date, never the body), groups every sender under the service it belongs to, and gives you one inventory:
- Every account, deduplicated: mail from amazon.com, amazon.fr and amazon.de ends up on one Amazon line.
- When you signed up and when it last wrote: accounts silent for six months are marked dormant, after two years forgotten.
- Breach and security notices: any service that emailed you about a data breach or incident is flagged first.
- The ones that bill you: paid accounts you no longer use are marked for cancellation.
- An action for each account: keep, secure, cancel or delete, with a link to the service’s account page when we know it.
The result is summed up as a digital hygiene score out of 100, so you can see it improve as you work through the list.
Read-only, and nothing leaves your browser
A tool that lists all your accounts knows a lot about you, so it matters where that list lives. HealthInbox asks Google for read-only access, fetches headers only and does all the analysis inside your browser. It cannot delete, send or change a single message, and no email data reaches our server. The only thing we ever receive is a license check with your Gmail address.
What to do with each account
- Reported a breach: change the password now and turn on two-factor authentication. If you reused that password elsewhere, change it there too.
- Still billing you, no longer used: cancel the subscription before the next renewal, then close the account.
- Forgotten for years: delete it. Most services have a “delete account” page in settings; in the EU you can also ask for erasure under the GDPR.
- Dormant but still useful: keep it, but make sure it has a unique password.
- Active and wanted: nothing to do. Mark it as kept so it stops showing up.
See how many accounts your email is linked to. The free version shows your hygiene score and account count; the full inventory is part of Pro (10 EUR/year).
Get HealthInboxFAQ
How do I find all accounts linked to my email address?
Every service you sign up for sends you an email: a welcome message, an address confirmation, a password reset or a policy update. Searching your inbox for those emails gives you the list. You can do it by hand with the Gmail searches above, or let HealthInbox scan your Gmail headers and group the results into one inventory, inside your browser.
How do I find old accounts I forgot about?
Look for services that emailed you once and then went quiet. HealthInbox marks an account dormant when its last email is more than six months old, and forgotten after two years, so the old ones rise to the top of the list.
Can I see which of my accounts were in a data breach?
When a service notifies you of a breach or security incident by email, HealthInbox flags that account and recommends securing it first. For breaches you were never told about, also check your address on Have I Been Pwned.
Does HealthInbox read my emails to find my accounts?
It reads headers only: sender, subject and date. The message body is never requested. Access is read-only, so it cannot delete or change anything, and the analysis runs in your browser. No email data is sent to any server.