There is no dependable master list of every website where you registered an email address. To find forgotten accounts, combine searches of your inboxes with saved-password reviews, sign-in-provider connection lists, and—if you are checking for exposure—breach lookup. Each method reveals a different kind of evidence, and none is exhaustive. Once you identify an account, secure it or close it through that service’s own process.
Can you find every account linked to your email address?
No single provider or service can reliably show every account created with an email address. An inbox may contain a welcome message, a password manager may contain a saved login, and a sign-in dashboard may show an app that used that provider. Those records overlap, but they are not the same thing as a complete registration history.
As an Amazon Associate I earn from qualifying purchases.
That distinction matters: finding an account in one source is useful evidence, while not finding it there proves little. A message could have been deleted; a password might never have been saved; an account might have been created with a different email address; or a site might not use the sign-in provider whose dashboard you checked. Treat each result as a lead to verify, not as a definitive inventory.
Recommended Free Tools
“How do I find all the accounts linked to my email address?” is therefore best answered with a process, not a single lookup. Work through every address you have used, preserve the evidence you find, and mark whether each lead is confirmed, uncertain, secured, or closed. This avoids both false reassurance and repeated recovery attempts.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What each method can—and cannot—tell you
| Method | What it may reveal | What it misses | Effort and privacy trade-off |
|---|---|---|---|
| Search email | Registration, verification, billing, subscription, and password-reset correspondence. | Accounts with deleted mail, different wording, another address, or no email correspondence you can find. | Usually low effort if you can access the inboxes. You do not need to submit your address to a separate lookup service. |
| Review saved credentials | Logins and passkeys stored in a particular browser, device, or provider account. | Accounts whose credentials were not saved there, or were saved in a different manager. | Requires access to the relevant manager or device. The list is limited to its own stored entries. |
| Check sign-in-provider connections | Some apps and sites connected through Google, Apple, or Microsoft sign-in or account controls. | Accounts created directly with an email and password, and connections outside that provider’s ecosystem. | Requires signing into the provider. The provider can show only the connections and products covered by its controls. |
| Check breach records | Whether an address appears in breach data indexed by Have I Been Pwned (HIBP). | Accounts not represented in indexed breach records, and accounts that have never appeared in a breach. | You submit an address to the breach-checking service. HIBP describes its purpose as assessing breach risk, not listing registrations. |
These methods are most useful together. A message naming a service can lead you to an account; a saved login can help you confirm how you accessed it; and a provider connection list can explain whether you used single sign-on. A breach result is a security signal, not another account directory.
Use the methods in an order that limits confusion: collect leads first, verify them second, and make security or deletion decisions third. Do not delete evidence before recording the service name and the address involved. Also keep in mind that the same service can appear twice if you created separate accounts with different addresses or used both a password login and a provider login.
1. Search every current and former email inbox
Start with every address you have used, not just the one you check today. Search the inbox, archived mail, and spam folder. If your email service supports searching across folders, use that; otherwise, repeat the searches in each folder. This is a practical search strategy, not a guarantee that every registration email will be found.
Include addresses from former employers, school accounts, older personal domains, and aliases if you still have legitimate access to them. An account may have been registered years ago, when a different address was your default. Never try to access an inbox you are not authorized to use.
Search for several kinds of messages
Try terms that appear in different stages of an account’s life:
- Registration: “welcome,” “verify your email,” “confirm your account,” and “account created.”
- Payments and ongoing use: “receipt” and “subscription.”
- Access and recovery: “password reset” and “sign-in.”
Search terms are clues, not exact filters: a company may use different wording, and a message may be in a folder or label your first search did not cover. Search the company or product names you already recognize as well as the phrases above. When you find a likely message, inspect its sender, date, and contents before treating it as proof that the account is yours; a receipt or notification can sometimes relate to a shared address or another person.
Search both broad phrases and distinctive details. A merchant name, newsletter name, billing descriptor, or domain in the sender field may find messages that do not contain “welcome.” Repeat searches with and without quotation marks if your provider supports both styles. Check older mail by date when the service offers date filters, since a forgotten registration may predate your current folder organization.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use messages to build a verification list
Record the service name, the email address that received the message, and what the message indicates—registration, payment, or recovery. Avoid putting passwords or full payment details in this list. A message can establish that an address received correspondence, but it may not establish that an account remains active or that you still control it.
Save only the minimum evidence needed, such as the sender, subject, date, and service URL. Do not forward sensitive messages to an unrelated address merely to keep notes. If another person shares the mailbox, label leads that require confirmation rather than assuming every message represents your account.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If you find a password-reset message you did not request, do not follow its link as a discovery shortcut. Open the service through its known website or app and review its security and recovery options. An unsolicited reset message is not, by itself, proof that someone accessed the account.
2. Review saved passwords and passkeys
Check the password manager or credential store you actually use on each relevant browser, device, and provider account. Do not assume that one device’s list includes credentials saved elsewhere. Look for unfamiliar service names and entries associated with the email addresses you are investigating.
Review passkeys as well as conventional passwords. A passkey entry can identify a service even when no password was saved, but it still covers only the credential store where it appears. If you use more than one browser or device, repeat the review in each one instead of relying on a single synchronized view.
Google documents reviewing saved passwords with Password Checkup, including identifying weak, exposed, or reused credentials. Apple’s Passwords privacy documentation describes stored account information and compromised-password detection. These are useful ways to assess credentials that were saved in those systems, but neither turns the saved-password list into a complete record of every site where you registered.
How to interpret a credential entry
- A saved username may be an email address, a different username, or a value you no longer recognize. Check the entry’s site information and sign-in details before deciding which account it belongs to.
- A missing entry does not mean the account does not exist. You may have used another manager, never saved the login, or deleted the entry.
- A compromised-password warning is a reason to address that credential, not evidence that the account is currently being accessed by someone else.
- Two entries for one domain may represent separate accounts, regional sites, or an old and a current login. Verify before deleting either entry.
If you identify a password reused on multiple services, change it on each affected account and give each one a unique password. Google’s suspicious-activity guidance also recommends changing reused passwords on other accounts. Keep track of where you have updated the credential so that an old password is not left in use on a less obvious service.
Do not send a password, passkey recovery code, or exported credential file to anyone helping with the review. A credential list is sensitive even when it is being used for housekeeping. Lock the device or manager when you finish and remove temporary notes that contain more information than you need.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →3. Check the sign-in providers you use
Sign-in dashboards can reveal accounts connected through a provider’s own sign-in method. They do not reveal every site that has your email address. Check each provider you have used, and read the connection details before removing access: disconnecting a sign-in method can affect how you get into that particular service.
Check every relevant provider account, not merely the address you are auditing. For example, two Google Accounts can have different connected-app lists. If you disable a connection, first confirm that the service has another login or recovery method; otherwise you could lock yourself out.
Google provides controls for reviewing apps with access to your account and managing information shared with third-party apps and sites through Sign in with Google. Review the connections in the Google account you used. The list is relevant to that account and its provider-mediated connections; it is not a list of every service where you entered the same email address directly.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Google also recommends Security Checkup, reviewing account recovery options, and checking saved passwords. Its suspicious-activity guidance includes reviewing apps with access and changing reused passwords on other accounts. Use these security controls after discovery to review access and reduce risk, rather than treating them as an account-finder for the whole internet.
Apple
Apple’s Sign in with Apple controls let you review apps using that feature and disable the sign-in. Check the Apple Account you used for those connections. This view covers apps using Sign in with Apple, not registrations made directly with an email and password or accounts tied to another sign-in provider.
Some Sign in with Apple connections may use a private relay address rather than your visible personal address. Record that relay address with the service lead so you do not mistake it for an unrelated account. Disabling the connection does not automatically close the app’s underlying account; use the app’s own closure process if you want the account deleted.
Microsoft
Microsoft Support documents reviewing products and services used with a Microsoft account, as well as usernames associated with a device. Check the Microsoft account and device information relevant to you. These pages can surface some products, services, or usernames, but should not be read as a complete list of every account registered to an email address.
A device username can be a clue rather than a separate online registration. Confirm the service and sign-in path before taking action, especially on a shared or formerly managed device.
Provider controls and menu names can change. The official Google, Apple, and Microsoft instructions available on October 13, 2026 describe the capabilities above; follow the current instructions for your own account and region rather than assuming that an identical screen or label appears everywhere.
4. Use breach lookup only to check exposure
Have I Been Pwned (HIBP) can help you assess whether an email address appears in breach data indexed by the service. Its FAQ says the site is “simply intended to be a free service for people to assess risk in relation to their account being caught up in a breach.” That is a statement of the service’s purpose, not a promise to identify every account associated with an address.
A result can help you prioritize security work, but it does not tell you that every listed account is still active, or that an attacker currently has access. A clean result does not show that no accounts exist: it means the lookup did not identify a matching record in the breach data available to the service. HIBP separates its email breach search from its password service; checking an email address and checking a password are distinct activities.
Use breach lookup when your goal includes checking possible exposure, not as a substitute for inbox searches or account-provider controls. If you choose to use it, consider that you are submitting the address to an external service. Review the service’s own explanation of its lookup and data handling before deciding whether that trade-off suits you.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For an address that appears in a breach, visit the affected service through its official site, change the password there, and change any reused version elsewhere. Treat the breach date and exposed data categories as context, not as proof that the account is currently compromised. A breach listing may reflect an old account you already closed.
5. Verify each lead and decide what to do
When a source points to a service, use that service’s official sign-in or account-recovery process to confirm whether you can access the account. Do not rely on a display name in a password manager or an old email alone to establish account status. If you cannot sign in, use the service’s own recovery path; a forgotten account may have outdated recovery details.
Type the known domain yourself or use the service’s established app rather than trusting an unexpected message link. During recovery, check that the address and phone number shown belong to you before continuing. If the service reports that no account exists, keep the lead marked unresolved: spelling differences, a different address, or a deleted account can produce the same result.
For each confirmed account, decide whether you still need it. For accounts you keep, review recent activity and recovery details, replace reused or exposed passwords with unique ones, and enable stronger sign-in protection where available. For accounts you no longer want, use the service’s own account-closure process. Deleting a message, saved login, or provider connection is not the same as closing the underlying service account.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Some services retain information for a period after closure or require a separate data-deletion request. Read the service’s current explanation before confirming deletion, and save the confirmation or date in your notes. Do not close an account that controls access to another service until you have changed that dependency.
Prioritize accounts with the clearest security impact
- First, address exposed or reused credentials. Change the password on the affected service and every other account where you reused it.
- Next, review recovery and access. Check account activity and recovery details on accounts you still use, and remove third-party access you no longer recognize or need.
- Then close accounts you have decided to leave. Follow the service’s own process and confirm what happens to the account and its data before completing closure.
For additional protection on Apple Accounts, Apple recommends security keys. A security key helps protect sign-in; it does not discover accounts. Support and compatibility depend on the service and device, so confirm those requirements before relying on a key. The same principle applies to any FIDO2 security key: it is a follow-up authentication measure, not an account-finding tool.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why a search can miss an account
Each source has a different blind spot. Inbox searches depend on messages that still exist and wording you think to search. Credential lists depend on what was saved and where. Provider dashboards depend on the provider and sign-in method. Breach lookups depend on indexed breach records. A missing result in one source is therefore not a reason to stop checking the others.
There are also ordinary reasons a lead can be ambiguous: an account may use an old email address, a username rather than an address, a shared inbox, or a sign-in provider you have not checked. Keep separate notes for accounts you have confirmed, accounts that are only possible leads, and accounts you have closed. That makes it easier to avoid mistaking a suspicious-looking email for a confirmed account or spending time trying to recover one you already handled.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsPrivacy choices also affect the process. Inbox and local credential reviews keep the search within systems you already control. Provider dashboards require you to sign in to those providers. A breach lookup sends the address to an external service. Choose the narrowest source that answers the question you have, and do not submit additional addresses unnecessarily.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
A practical sequence to follow
- List the current and former email addresses you want to check.
- Search each inbox, archived mail, and spam for registration, payment, subscription, and password-reset terms.
- Review saved passwords and passkeys in each password manager, browser, device, and provider account you use.
- Review connected apps and account controls for each sign-in provider you have used, including Google, Apple, and Microsoft where applicable.
- Use HIBP if you also want to assess whether the address appears in indexed breach data.
- Verify promising leads through each service’s official sign-in or recovery process, then secure or close confirmed accounts.
- Record the outcome and the date so a future review starts with unresolved leads rather than repeating completed work.
This sequence combines different kinds of evidence without confusing a breach check with an account inventory or a provider connection list with a universal registry. It can substantially improve your visibility while leaving room for accounts no available source can surface.
Frequently Asked Questions
How do I find all the accounts linked to my email address?
There is no universal registry. Search every current and former inbox, review saved passwords and passkeys, check each sign-in provider’s connected-app controls, and use Have I Been Pwned only to assess breach exposure. Verify each lead through the service itself.
Can Google show every website that uses my email address?
No. Google can show apps and sites connected through the relevant Google Account and Sign in with Google. It does not list accounts where you entered the address directly or used another provider.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Does a clean Have I Been Pwned result mean I have no accounts?
No. It means the address was not found in the breach records indexed by the service. HIBP is a free breach-risk assessment service, not an account inventory.
Should I delete a saved password when I find an old account?
Not immediately. First confirm whether the account is yours and whether you want to keep or close it. Secure or close the account through its own process, then remove obsolete credential entries if appropriate.
What should I do if I find a reused or exposed password?
Change it on the identified service and every other account where it was reused. Give each account a unique password, review recovery details and activity, and enable stronger sign-in protection where supported.
Does disabling Sign in with Apple or another provider close the account?
Usually it only removes or disables that provider-mediated sign-in connection. It does not necessarily delete the service account. Use the service’s own account-closure process if you want it closed.
Recommended Free Tools
The Bottom Line
No tool can produce a complete list of every account tied to an email address. Combine inbox evidence, saved credentials, provider connection lists, and breach checks, then verify each lead directly. Secure accounts with reused or exposed credentials, and close unwanted accounts through the service that created them.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
