Stop Third-Party Apps From Reading Your Email

Third-party apps may have permission to read, send, or manage email through your account, even after you stop using them. Revoking access prevents future access through that authorization, but it cannot erase messages an app already copied or undo actions it already took. You’ll need to review permissions with your email provider and remove access you no longer trust.

What You’ll Need

A phone or computer with internet access.
Access to the email account’s security settings. If you use more than one email account, check each one separately.
Your password and, if prompted, access to your provider’s verification method.

Step-by-Step

List the accounts and apps to check. Note every email address you use, including work or school accounts. Think of apps that connect to mail, such as email clients, calendars, contact managers, file services, or tools that organize messages. Check the provider’s security settings rather than relying on a list inside one device; an app may have access even if it is not currently installed.
Open your email provider’s account security page. Sign in directly through the provider’s official website or app. Look for a section named something like Security, Privacy, Connected apps, Third-party access, or Apps with account access. Menu names and locations vary, so use the provider’s own help pages if you cannot find the section. Avoid following account-security links from unexpected emails or messages.
Review the connected apps and permissions. For each entry, check the app name, developer, when access was granted, and the permissions listed. Look for access to read, send, delete, or manage email. Some services show broad permissions such as access to all data in an account rather than a separate email permission. If you cannot identify an app or understand its access, treat it cautiously and look it up using a trusted source before deciding whether to keep it.
Revoke access for apps you do not need or trust. Select the app and choose an option such as Remove access, Disconnect, or Revoke permissions. Confirm the change if asked. Remove access one app at a time so you can see what has changed. If you use an app for email, removing its access will usually stop it from syncing or sending through that account; you may need to reconnect it later and approve only permissions you understand.
Check device and mail-client access separately. A mail app configured with your account may use a provider sign-in permission, an app-specific password, or another connection method. Review the provider’s connected-app list and its password or sign-in settings for app passwords or older mail access. Remove credentials you no longer use. Do not delete a credential that a device still needs unless you are ready to set it up again.
Review forwarding, filters, and delegates. Third-party access is not the only way mail can be shared or redirected. In the email settings, check forwarding addresses, rules or filters that automatically redirect or delete messages, delegated access, and accounts that can send mail as you. Remove entries you did not set up or no longer need. If this is a work or school account, some settings may be managed by an administrator.
Secure the account if anything looks unfamiliar. Change your password from the provider’s official security settings, choose a unique password, and turn on two-step verification if available. Review recent sign-ins and sign out unknown sessions or devices. If an unfamiliar app had access, consider that messages or attachments may already have been copied; revoking access does not retrieve those copies. Contact your provider or workplace administrator if you see suspicious activity you cannot explain.
Test the change and repeat for other accounts. Refresh the connected-apps page to confirm the app is gone or marked as disconnected. Check each email address separately, including accounts added to phones and computers. If a legitimate app stops working, decide whether you want to reconnect it; read the permission request carefully and deny access if it asks for more than the feature requires.

Common Mistakes

Deleting the app instead of revoking permission. Uninstalling software from a phone or computer may leave its account authorization active. Revoke it with the email provider.
Changing the password and assuming every app is disconnected. Some authorizations or app passwords may remain valid. Check the provider’s access and credential settings as well.
Removing every unfamiliar-looking entry without checking. An entry might belong to a mail client, device, or service you rely on. Identify it where possible, then reconnect only if needed and the permissions are acceptable.
Expecting access removal to erase data already obtained. Revocation blocks future use of that permission; it does not guarantee deletion of copies already downloaded or stored elsewhere.
Checking only one email address. Permissions belong to particular accounts. Repeat the review for each personal, work, or school account you use.

Tips

Review connected apps periodically and whenever you stop using a service.
Prefer sign-in methods that let you grant limited permissions, and read the permission screen before approving it.
Keep a note of essential apps and why they need access. This makes future reviews easier without requiring you to keep unnecessary connections.
Use a unique password and two-step verification. These reduce the chance that someone can sign in directly, but do not replace reviewing app permissions.
For shared or managed accounts, ask the owner or administrator before changing settings that could interrupt other people’s access.

Troubleshooting

You cannot find connected apps: Search the provider’s help center for terms such as “third-party access” or “revoke app access.” Check that you are signed into the correct account, especially if you have multiple addresses. Work and school administrators may control these settings.

The app still appears after removal: Refresh the page or sign out and back in. Check whether the entry is a separate device session, an app password, or a second authorization. Remove the relevant item from its own settings page; uninstalling the app alone may not do this.

Your mail app stops syncing: That can be an expected result of revoking access. If you still want to use it, open the app and sign in through the provider’s supported sign-in flow. Review the permissions before granting them. If the app cannot connect without access you do not accept, use another method to read mail.

You suspect someone accessed your account: Use the provider’s official security page to change your password, review sign-ins, remove unfamiliar access, and enable two-step verification. If you cannot regain control, follow the provider’s account-recovery process. For a managed account, contact its administrator promptly.

Frequently Asked Questions

Does revoking access delete emails an app already downloaded?
No. It stops future access through that authorization, but cannot reliably erase copies already saved by the app or its service.

Will removing access delete the app from my phone?
No. Remove or uninstall the app separately if you no longer want it. Uninstalling it does not necessarily revoke its account permission.

Can an app read my email if I never approved it?
It should not be able to use an account authorization you never granted, but someone may have signed in directly or changed forwarding settings. Review sign-ins, connected apps, and mail rules if you are concerned.

Should I revoke access from every app?
Not necessarily. Keep access for services you recognize and need, provided you understand their permissions. Remove access that is unnecessary, unexplained, or broader than you are comfortable granting.

Does changing my email password revoke third-party access?
Not always. The effect depends on the provider and how the app connects. Explicitly review and revoke app permissions, sessions, and app passwords.

What if this is a work or school email account?
Your administrator may manage connected apps or prevent you from changing access. Contact them if you see an unfamiliar connection or cannot remove one.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →