What To Do About Your Old Usernames
The 30-minute habit that shrinks your attack surface
Using unique usernames is a great habit. And as we announced a few weeks back, we created a simple tool to make the process easy for you. See here:
But what about the accounts you’ve already created?
Even if you start fresh today, your old usernames are still searchable. OSINT tools can find that gaming handle you used in 2012, connect it to your yahoo account, and keep pulling the thread until they’ve built a profile on you. The past doesn’t disappear just because you’ve changed your habits.
So what do you do about it?
Schedule an Account Cleanup Day
Rather than trying to fix everything at once (you won’t), block 30-60 minutes on your calendar for an account cleanup. It could be quarterly, monthly, or some other frequency. The important part is that it’s something you can follow through on.
Is this annoying? Of course.
Is it necessary? Depends on your risk profile and how much you like to try and future proof things.
If you decide this is a worthwhile exercise, here’s how to spend that time:
1. Pull up your password manager. Sort by oldest accounts or just scroll through the list. You’ll probably be surprised by how many you’ve forgotten.
Don't have a password manager? Your email inbox is the next best thing. Search for terms like "welcome," "confirm your account," "verify your email," or "thanks for registering." You'll be surprised how many forgotten accounts surface. This is also a good reminder to start using a password manager, which makes future cleanup days much easier.
2. For each account, ask three questions:
Do I still use this? If not, delete it.
Can I change the username? If yes, swap it for a unique one.
Is this a high-value account? Prioritize email, banking, healthcare, and anything tied to your real identity.
3. Close what you don’t need. Old accounts are liabilities. They sit in breach databases, they’re searchable by OSINT tools, and they add to your attack surface. If you haven’t logged in for a year, you probably don’t need it. Sites like justdelete.me can help you find the delete option (some companies bury it on purpose).
Before deleting an old account, it’s best practice to change as much information in the account as you can. Switch any personal information to non-identifying data. For example, your name become Jack/Jane Doe, you make up a DOB, you make up an email address, etc. This is because although you delete your account, the account data remains in the company’s system for a set period of time. If there’s a breach a year from now, your fake data gets leaked, not your real data that you thought was deleted.
Prioritize the High-Value Targets
If you’re short on time, this section lays out how we recommend prioritizing the accounts.
Email accounts — The skeleton key to your digital life. If someone gets into your email, they can reset passwords everywhere else.
Financial accounts — Banks, credit cards, investment platforms.
Healthcare portals — Contain sensitive personal data.
Social media with your real identity — LinkedIn, Facebook, anything with your actual name attached.
Your password manager itself — If you’re using your email as the username, consider changing it.
Everything else, like old forums, random shopping accounts, that app you tried once, can wait for your next cleanup day.
There is one problem you will run into rather soon:
many websites won’t let you change your username.
If you encounter that, your options are, unfortunately, not great. If you need to have an account with the website, you can try reach out to tech support to request a manual username change. That probably won’t work, but it’s worth a shot.
Another option is to start over with a fresh account, though those use cases are limited. Closing a bank account and then opening a new one, for example, probably isn’t worth the effort. In the end, don’t go crazy here unless you have a high risk profile or enjoy the challenge.
The Bigger Picture
If you want to go deeper than usernames, our How Exposed Are You Online? guide walks you through a full self-audit using the same OSINT techniques that investigators and doxxers use. It covers key exposure areas and links to the tools (many free) so you can see exactly what’s findable about you, and fix it.
But even without the full audit, scheduling a cleanup day twice a year will put you ahead of most people. Small upgrades snowball into big wins over time.
Your past doesn’t have to stay searchable forever. The important part is to start pulling those threads on your time, before someone else does.
🔖 Bookmark Our Username Generator
Don’t forget to bookmark our free username generator. You can even add a shortcut to your mobile phone home screen for easy access. That helps remove the friction with creating unique usernames and puts you ahead of 99% of the population.
Friendly Ask
If you found this helpful or informative, chances are your friends and family will as well. Please share it with them to help spread awareness.
Looking for help with a privacy issue or privacy concern? Chances are we’ve covered it already or will soon. Follow us on X and LinkedIn for updates on this topic and other internet privacy related topics.
Disclaimer: None of the above is to be deemed legal advice of any kind. These are *opinions* written by a privacy and tech attorney with years of working for, with and against Big Tech and Big Data. And this post is for informational purposes only and is not intended for use in furtherance of any unlawful activity. This post may also contain affiliate links, which means that at no additional cost to you, we earn a commission if you click through and make a purchase.
Privacy freedom is more affordable than you think. We tackle the top Big Tech digital services and price out privacy friendly competitors here. The results may surprise you.
Do you own a Smart TV? If so, you won’t want to miss this reader fav post Smart TV Privacy Settings: How to Disable Tracking on Every Brand.
If you’re reading this but haven’t yet signed up, join for free (4.4K+ subscribers strong) and get our newsletter delivered to your inbox by subscribing here 👇
Love this! Another technique I like is every time I get a marketing email, I use it as a reminder to see if I still need an account with that company!
This is excellent advice and should be a part of everyone’s routine digital audit. Great tips, thank you for offering this!