Are X (Twitter) unfollow trackers safe to connect?

It depends on what you hand over. You can be asked for six different things, listed here from most to least dangerous.

With the first three, X never shows you what the tool will be allowed to do, because it's acting as you. The two sign-in rows are the method X's help page on third-party apps recommends, since no username or password goes to the tool.

If you'd rather hand over nothing, you can compare your followers list by hand. It's one of the ways to see who unfollowed you that need no tool.

As of October 2026, the screen shows two lists for apps on X's newer sign-in method, headed "Things this App can view" and "Things this App can do". Apps on the older method ask for one of three levels: "Read", "Read and Write" or "Read, Write, and Direct Messages".

Read the second list first. A tool that only reports who unfollowed you has no reason to post, follow or unfollow for you. If the screen shows following and unfollowing people for you under that heading, the tool can change who you follow.

Permission to act is what went wrong in the cases we know of. In April 2011, NBC News and the security writer Graham Cluley reported scam apps that promised to show who unfollowed you: once someone authorised one, it tweeted the same promise from their account. Cluley reported more of them in March 2012. In March 2017, according to PCWorld, a breached analytics app with permission to post was used to post from accounts including Forbes and Amnesty International. Apps promising to show who viewed your profile have spread the same way since 2009.

Permission to view still gives a lot away. X's examples of what an app can view include the people who follow you, protected posts you can see and the accounts you've muted or blocked. What the app then stores or shares is up to the app, so read its terms and privacy policy before you accept.

An app on the newer method can also ask to stay connected until you revoke its access, so one you accepted years ago can still be connected today.

No. Anyone who has your username and password has complete control of the account. They can lock you out, or do things that get it suspended. X doesn't share your password with apps, so a tool that asks for yours is working outside X's sign-in.

If you doubt a login page, open x.com yourself and sign in there first. A real sign-in through X (OAuth) shouldn't ask for your password again.

Same answer for your cookies. Whoever holds a copy of your session cookie is signed in as you, with no password and no two-factor prompt. X's authenticity policy lists cookies and tokens next to passwords as login data that gets accounts compromised when it's shared with a malicious app or site.

Browser extensions belong here too. An unfollow extension doesn't need you to log in, because it works inside the X tab where you're already signed in and sends requests as you. X's automation rules forbid scripting the X website and say it may lead to permanent suspension, and the account doing the scripting is yours.

1. 1

   Open "Apps and sessions"

   Sign in to X and open your settings. As of October 2026, "Apps and sessions" is in the part about security and account access.

2. 2

   Read each app's permissions

   The connected apps are listed there, each with its permissions under its name.

3. 3

   Revoke what you don't use

   That goes for anything you don't recognise too. X's help page describes a "Revoke access" button next to the app, or at the bottom of the app's own page once you open it.

4. 4

   Look at your sessions

   The same section shows where your account is logged in, with a location and a time. You can log out one session, or all the others at once.

If you typed your password into a tool you no longer trust, do both: revoke its access and change the password. A new password doesn't by itself log the account out of X's iOS and Android apps, so log out your other sessions as well.

It can. X's automation rules forbid apps that unfollow in bulk, and they hold you responsible for what an app you connected does with your account. What X does when it catches it, and the slower way to unfollow many accounts, are in how to mass unfollow without getting suspended.

You sign in on X's own page, so we never see your password. We don't ask for your X cookies, and we have no browser extension. Read X's permission screen before you accept, as you would for any other tool.

From the sign-in we take your username, display name, profile picture and the ID number X gives your account, which tells us whose followers to watch. We don't read your followers through that sign-in. Your followers list is public data, and we read it by your username through a data provider, which our privacy policy names.

The only thing we ever write on X is a DM, sent from our own account, @unfollowmonkey, to you. We don't post, like, repost, follow, unfollow, block or mute from your account, and we don't send DMs from it.

UnfollowMonkey

@your_ex unfollowed you 🙈 💔

They followed you for about 3 years.

@moon_signals_88 got suspended 😱

What we store is mostly lists: who follows you, who you follow, and who left. We may also hold your email address, if the sign-in gave us one. If our database leaked, it would expose those. It wouldn't expose your X password, your posts, your likes or your DMs with other people, because we don't store them.

To leave, press "Delete account" in Settings. It cancels any subscription and deletes your account and tracked data. Our privacy policy allows 30 days for that, except for records we have to keep, for tax or fraud prevention for example. Deleting sends nothing to X, so revoke our access in "Apps and sessions" too.