Short answer
When you click “Sign in with Google” or let an app connect to Instagram, Facebook, X or Microsoft, you give it a standing permission that does not need your password each time. Some apps can read your email, post for you or see your followers. After a hack — and once a year anyway — open the list and remove every app you don’t use or recognise: Google Account → Security → Your connections to third-party apps & services; Microsoft account → Apps and services you’ve given access; Facebook → Settings → Apps and websites; Instagram → Settings → Website permissions; X → Settings → Security and account access → Apps and sessions.
Why connected apps are a risk
- On many services an app’s access isn’t tied to your password, so it can survive a password change until you remove it.
- Free “who viewed my profile”, follower-count and quiz apps often ask for far more than they need — some exist only to collect data or post spam.
- An attacker who had your account may have connected an app of their own to get back in later.
- Apps you stopped using years ago still hold whatever permission you once gave them.
Where to review connected apps
| Platform | Where to look | What to do |
|---|---|---|
| Google Account → Security → Your connections to third-party apps & services | Select the app → Remove access, or Stop using Sign in with Google | |
| Microsoft | account.live.com/consent/Manage (Microsoft account → Privacy) | Remove the permissions of apps you don’t use |
| Settings & privacy → Settings → Apps and websites | Remove; you can also ask the app to delete your data | |
| Settings → Website permissions → Apps and websites | Remove active apps you don’t recognise | |
| X | Settings and privacy → Security and account access → Apps and sessions → Connected apps | Revoke app permissions |
What to remove — and what to keep
- Remove anything you don’t recognise or no longer use, and anything that can read messages or email or post on your behalf without a clear reason.
- Keep services you actively sign in to with Google, Apple or Facebook — or set a password on that service first, because removing the link may lock you out of it.
- Removing access stops future use; it doesn’t delete what the app already copied. Google notes that stopping “Sign in with Google” doesn’t delete your data in the app — ask the developer if you want it erased.
After a hack: the order that works
- Secure the email account and change passwords from a clean device.
- Sign out of every session — see how to check logged-in devices.
- Review connected apps on every platform above and remove the unknown ones.
- Check email forwarding, filters and rules.
- Turn on app-based two-step verification or a passkey.
Red flags in an app request
- A follower tracker or giveaway tool asking to read and send messages or manage your account.
- An “app” that wants you to type your password into its own page instead of the platform’s sign-in screen — that is phishing, not an app login. See fake Meta and Instagram emails.
- A “verification”, “copyright appeal” or “recovery” tool sent by direct message. Platforms don’t ask you to install anything to appeal.
Frequently asked questions
Does changing my password remove connected apps?
Not always. App access is often granted separately from your password, so review the connected-apps list and remove what you don’t use.
Is “Sign in with Google” or “Continue with Facebook” safe?
Generally yes — it is safer than typing your password into an unknown site — as long as you check what access the app asks for and remove it when you stop using the service.
Will removing an app delete my data from it?
No. It stops the app’s future access. Data it already collected stays with the developer unless you ask them to delete it.
How often should I check connected apps?
After any suspected hack, and otherwise every few months, together with your logged-in devices.
Sources: Google Account Help — manage links between your Google Account and third-party apps, X Help — third-party apps and log-in sessions, Instagram Help Center — account security, Meta Business Help — how do I secure a hacked account?, Microsoft Support — recover a hacked or compromised Microsoft account