47 Apps I Forgot Existed: What Happens When You Actually Read Your Google Security Page

There's a particular kind of horror in scrolling through a list of services that can read your email, and realizing you can't remember signing up for most of them.

That was my Saturday. I'd been meaning to do a proper security audit of my Google account for months — the kind of thing I recommend to friends and then never do myself, because nobody does. Then a reader email about a data breach at some long-defunct calendar app pushed me over the edge, and I opened up my Google Account settings with a coffee and low expectations.

Forty-seven. That's how many third-party apps had active access to my account. I counted. I made a spreadsheet, because that's the kind of person I am.

Where the bodies were buried

If you've never done this: go to your Google Account, hit Security, then find "Third-party apps with account access." What you'll see is a graveyard of your digital impulse decisions.

My list included:

• A to-do app that shut down in 2019 but apparently still held a live token
• Four different read-later services (I use none of them)
• A browser extension for managing tabs that had full Drive access, which — no
• A conference scheduling tool from a job I left in 2021
• A "free PDF merger" website I genuinely remember using exactly once

Here's the thing that gets me. Most of these grants are years old. OAuth tokens don't expire just because the app does. If a company gets acquired, gets breached, or gets bored, whoever ends up with their infrastructure may still end up with a working pipe into your email, contacts, and files. Revoking access costs you nothing. Not revoking it is just a bet that nothing bad happens, placed at long odds, every single day.

The audit, step by step

This takes about 30 minutes. Do it in one sitting with a notepad open.

Step 1: Pull the list. Security → Third-party apps with account access. Google groups them by what they can touch, which is useful — anything with Gmail access deserves the most scrutiny.

Step 2: Sort into three piles. Use it regularly, might use it, and what is this. Be honest with the middle pile. If you haven't opened it in six months, it's in the third pile.

Step 3: Revoke ruthlessly. Click each one, hit "Delete all connections." Worst case, you re-authorize in 30 seconds next time you actually need it. That's the whole downside. There is no worse case than that.

Step 4: Check the sketchy ones twice. Anything you don't recognize, Google it before panicking — some system integrations have cryptic names. But if it's a free utility website with a Gmail scope, it goes.

Step 5: Set a calendar reminder. I put a recurring one on my birthday, because I'll actually see it. Annual permission audit, done.

What my 47 taught me

The pile skewed heavily toward tools I signed up for during two specific eras: the 2018-2019 productivity app boom, and every time I needed something to work "just for this one project." Those one-off authorizations are the real leak. Nobody re-evaluates them, because the mental model is "I'll deal with it later," and later never comes.

The other thing worth saying: Google actually does some of this work for you. It flags inactive accounts and unused connections, and the interface is better than it used to be. But it can't know that the tab manager extension you granted Drive access to in 2020 was a terrible idea. Only you know that. Well — you and whoever ends up with that token.

Do the audit. It's 30 minutes, it's free, and unlike most security advice, it doesn't require you to change a single habit afterward. Just close the doors you forgot you opened.