How most unfollower apps work
Instagram doesn’t offer a public way for outside apps to read a personal account’s full followers and following lists. So most “who unfollowed me” apps ask you to sign in with your Instagram username and password inside their own app or website. They then log in as you, often from their own servers, and collect your lists by scrolling through them automatically, sometimes several times a day.
That design is the root of almost every risk below. Whatever the app promises, once it has your password it can do anything you can do on your account.
The risks of giving an app your password
1. Full control of your account
Your password isn’t a key to your follower list only. It opens your messages, photos, saved posts, linked accounts and personal details. An app that has it could post, send messages, follow or unfollow accounts, or change your settings, and you’d have to trust it not to.
2. Leaks and stolen data
Even an app with good intentions has to store your login or session somewhere. Small apps don’t always protect that data well, and if their servers are breached, your account is exposed along with everyone else’s. If you reuse the same password elsewhere, those accounts are exposed too.
3. Breaking Instagram’s rules
Instagram’s Terms of Use don’t allow accessing or collecting information from the service by automated means without permission, and they ask you not to share your password or let others access your account. Apps that log in for you and pull your lists automatically can lead Instagram to flag the activity as suspicious.
4. Locked accounts and action blocks
Logins from unfamiliar servers and bursts of automated activity look a lot like an account takeover. Instagram may ask you to confirm your identity, reset your password or wait before you can follow, like or comment again. Some apps also offer “mass unfollow” buttons, which make this more likely.
5. Fake apps that only want your login
Some unfollower apps and websites are phishing: they show a convincing login screen, keep your password and use your account to send spam or sell it. Because people are curious about who unfollowed them, this is a popular bait.
Warning signs to look for
- It asks for your Instagram password on its own screen, not on instagram.com or in the Instagram app.
- It promises to show who viewed your profile or stories. Instagram doesn’t share profile visitors.
- It promises exact unfollow times for the past, before you ever used it.
- It offers to follow, like or unfollow in bulk on your behalf.
- It asks you to turn off two-factor authentication or send it a security code.
- Its privacy policy is missing, vague or doesn’t say where your data goes.
A safer way: use your own data export
Instagram lets every account download a copy of its information, including the complete followers and following lists. You request it while signed in to Instagram itself, so your password never leaves Instagram. Once you have the ZIP file, a follow-back checker only needs to read that file.
UNFOLLOWED works this way. It never asks for your username or password, can’t log in to your account and reads your export inside your browser, so the files aren’t uploaded. The trade-off is that it compares the lists in one export rather than watching your account, which is exactly what keeps it from needing access. Follow the download guide to get your files.
If you already gave an app your password
- Change your Instagram password, and change it anywhere else you used the same one.
- In Instagram’s Accounts Center, review where you’re logged in and log out of any session or device you don’t recognize.
- Turn on two-factor authentication if you haven’t already.
- Remove access for apps and websites you no longer use, and delete the unfollower app.
- Check your recent activity, messages and following list for anything you didn’t do.