How to secure or retire an old email address
2 min read · Updated October 15, 2026
Check the address for breaches, set a unique password with two-factor authentication, remove it as a recovery address on important accounts and switch accounts to a newer address. If you no longer need it, retire it only after moving everything that depends on it.
Why old addresses are risky
They were used before strong habits formed, appear in many old breaches and are often forgotten. They may still be your recovery email for important accounts, which makes them a hidden weak link.
Decide: keep, repurpose or retire
- ✓Keep: if accounts still depend on it. Secure it fully.
- ✓Repurpose: use it only for low-value sign-ups, newsletters and junk.
- ✓Retire: after moving accounts to a new address and removing it as a recovery option.
Check your email address for known leaks
Works with any provider. Enter your address, get a free exposure check, and see what to fix first.
Audit what depends on it
Search the inbox for welcome emails, receipts and password resets to find the accounts tied to it. Move important ones to a secure address and update recovery details. Delete accounts you do not use.
Secure what you keep
Use a new unique password, enable two-factor authentication and review forwarding and connected apps. Check the address in a breach lookup so you know how exposed it is.
Frequently asked questions
Should I delete my old email?+
Only after migrating everything important. Keeping it secured is safer than deleting it prematurely.
Can unused accounts be taken over?+
Yes. Unused accounts with old passwords are easy targets, and some providers eventually release inactive addresses.
How do I find accounts linked to it?+
Search the inbox for welcome messages, receipts and password-reset emails.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.