How to clean up and secure old online accounts with a password manager

Most people have dozens, sometimes hundreds, of old accounts scattered across the internet. Many of them reuse weak passwords and have outdated email addresses or recovery details. That mix is risky, but with a password manager you can bring order to the chaos in a few focused sessions.

This guide walks you through using any modern password manager to find old accounts, strengthen logins, and reduce the damage if a site is ever breached.

Step 1: Choose and set up a password manager

If you do not already use one, start by picking a reputable password manager that works on your devices and browsers. Popular options include 1Password, Bitwarden, Dashlane, and the built-in managers in browsers like Chrome, Safari, and Firefox. Look for end-to-end encryption, multi-device sync, and support for two-factor authentication.

Install the mobile app and browser extension, then create a strong master password that you do not reuse anywhere else. Enable two-factor authentication for the password manager account itself, ideally with an authenticator app or hardware key, not just SMS.

Step 2: Import and collect existing passwords

Your passwords may already be scattered across browsers and devices. Most password managers can import from Chrome, Edge, Firefox, or another manager via an export file. Follow your manager’s import instructions to pull these logins into one place.

As you browse and sign in, the extension will also offer to save new logins it detects. Accept these saves, even if the password is old or weak, because the goal now is to collect everything before you start cleaning up.

Step 3: Identify weak, reused, and exposed passwords

Modern password managers include a security or health dashboard. Open it and look for reports on weak passwords, reused passwords, and entries involved in known data breaches. These reports give you a prioritized list of what to fix first.

Focus on accounts marked as reused or exposed, especially for email, banking, shopping, social networks, and cloud storage. These accounts can often be used to reset passwords or impersonate you, so they deserve immediate attention.

Step 4: Change critical passwords with strong, unique ones

For each important account in your priority list, open the site, sign in, and go to its security or password settings page. Use your password manager’s generator to create a long, random password, typically at least 16 characters. Save the new login when prompted.

Work in small batches to avoid burnout, for example 10 accounts per day starting with your main email, password manager, banking, and major services like Apple, Google, and Microsoft. Once those are secured, move on to shopping, subscriptions, and social media.

Step 5: Turn on two-factor authentication wherever possible

Two-factor authentication adds a second step when you sign in, such as a code from an authenticator app or a hardware security key. Even if an attacker gets your password, they still need that second factor.

Visit the security settings for each important service and look for “Two-step verification” or “Multi-factor authentication”. Prefer app-based codes or hardware keys over SMS if available. Store backup codes in your password manager as secure notes so you can recover access if you lose a device.

Step 6: Review old and unused accounts

As you go through your password list, you will find sites you no longer use. For each one, decide whether you truly need the account. If not, sign in and look for an option to deactivate or delete it, often in settings or privacy sections.

Before deleting, remove any saved payment methods and personal data you can edit. If deletion is not possible, at least change the password to a strong, unique one and remove any linked accounts where possible, such as social logins or third-party app access.

Step 7: Update recovery emails, phone numbers, and backup options

Old accounts often point to outdated email addresses or phone numbers. In each important service, check your recovery and contact details and update them to addresses and numbers you actually control today.

Also review connected apps and devices. Remove old phones, laptops, or third-party apps you no longer use so that only your current hardware and trusted services can access the account.

Step 8: Make security maintenance a simple routine

Security is not a one-time project. Schedule a short monthly or quarterly review where you open your password manager’s security dashboard and fix any new issues. It should only take a few minutes once the initial cleanup is complete.

Going forward, avoid creating accounts you do not need, use unique passwords everywhere, and turn on two-factor authentication by default. With a password manager at the center of your setup, staying secure becomes a habit instead of a hassle.