Are unfollower apps safe? What happens when you hand over your login

What you give away when you log in to a follower app

Your password, or something just as good

When you type your username and password into a third-party app, the app has your credentials. Even if it promises not to store them, you can't check that. It has gone wrong before:

• In 2015, an app called InstaAgent, which claimed to show who viewed your Instagram profile, was found sending usernames and passwords to a remote server and posting photos to some users' accounts without asking. Apple and Google removed it from their stores (MacRumors, CNN).
• In 2017, the security firm ESET found 13 Android apps that promised more Instagram followers but sent the logins users entered to a remote server. The stolen accounts were then used to boost other people's follower counts. The apps had reached up to 1.5 million users before Google removed them (ESET WeLiveSecurity).

That doesn't mean every follower app today is malicious. But once your password is on someone else's server, you depend entirely on that operator's honesty and security.

"We never see your password" isn't the whole story

Some apps don't ask for your password directly. Instead, they show Instagram's login page inside the app. That looks safer, but it depends on where the page opens:

Built-in browsers can inject their own JavaScript into the pages they display. The security researcher Felix Krause demonstrated this in 2022 for the in-app browsers of several large apps (krausefx.com). Any app that shows a login page this way has the same technical option. A session cookie is enough to use an account without knowing the password.

Why an official permission screen doesn't solve this

Meta shut down the Instagram Basic Display API, which many consumer apps used for personal accounts, on December 4, 2024 (TechCrunch). The current Instagram API returns an account's followers_count and follows_count, but it has no endpoint that lists who those followers are (Meta for Developers).

So if an app shows you a complete list of your followers after you log in, it isn't getting that list from an official endpoint. Typically it uses your session the way the Instagram app would. Instagram's Terms of Use say: "You can't attempt to create accounts or access or collect information in unauthorized ways."

What Instagram says about these apps

Instagram's Help Center addresses apps that offer likes and followers (Why you should not use apps that offer likes and followers, Third-party apps). It doesn't have a separate page on unfollower trackers, but the warning about handing over your login applies to any app:

• Apps that offer followers or likes are not affiliated with or endorsed by Instagram.
• If you give such an app your login, whether as a username and password or as an access token, it can get complete access to your account, including your messages, and can post spam.
• Instagram may remove likes and other engagement such an app generated. Accounts that keep using apps to get more followers may find parts of the account limited, and the account may be disabled or terminated.

Instagram doesn't publish exact thresholds for when it restricts an account, and many of the guesses you'll find online aren't backed by anything. What Instagram does offer is Account Status: open your profile, tap the ☰ menu, and under More info and support tap Account Status. It shows removed content and features you can't use, and for professional accounts also whether your content can be recommended to non-followers (Account Status, recommendation eligibility). If you're worried about a follower app you used in the past, check that page. Our guide to checking and fixing limited reach explains what each entry means.

Already used a follower app? How to clean up

If you've logged in to a follower, unfollower or "profile viewer" app at some point, work through these steps in the Instagram app. Menu names can differ slightly between app versions; if you can't find an item, type its name into the search field at the top of Settings and activity.

1. Remove connected apps. Go to your profile and tap the ☰ menu. Under Your app and media, tap Website permissions, then Apps and websites. On the Active tab, tap Remove next to anything you don't recognize or no longer use. Check the Expired tab as well: those apps no longer have access, but they may still have data they collected before (< href="https://help.instagram.com/1144624522593085" rel="noopener noreferrer">Instagram Help).
2. Check where you're logged in. Open Accounts Center (Meta is gradually renaming it Meta Account, so you may see that name) → Password and security → Where you're logged in. Log out of every device or location you don't recognize (Instagram Help).
3. Change your password in the same Password and security section. Use a password you don't use anywhere else. This matters most if you ever typed your password into the app, because an app that only had your password doesn't necessarily appear under Apps and websites.
4. Turn on two-factor authentication under Password and security → Two-factor authentication. An authentication app is more robust than SMS codes.
5. Delete the app from your phone. Removing it from Instagram's list doesn't remove it from your device.
6. Check Account Status (☰ menu → More info and support → Account Status) for any restrictions.

The alternative: analyze your own data export

Data protection laws such as the GDPR give you the right to receive data you provided in a "structured, commonly used and machine-readable format" (GDPR Art. 20). Instagram, TikTok, X and Facebook all offer such an export, and it contains your follower and following lists (on Facebook, your friends list too).

Working from the export has clear advantages and some real limitations:

The waiting time is the main downside. A followers-only Instagram export is often ready within minutes to a few hours, though Meta says it can take longer. TikTok and X say it can take a few days. Instagram, TikTok and Facebook keep a finished export available for 4 days (Instagram Help).

Keep the export small

The export is personal data too, so request only what you need:

• Instagram: start from Your information and permissions in Accounts Center, choose Export your information, pick only Followers and following and the format JSON. The Instagram export guide walks through each screen.
• Facebook: select only Friends and followers and the format JSON.
• TikTok: choose Custom and select at least Profile and settings, where the follower lists are. See how to request your TikTok data.
• X: the archive always contains everything, including media. On a computer you can unzip it and select only follower.js and following.js from the data folder.

Step-by-step instructions for all four platforms are in the tutorial. Once you have your result, delete the ZIP from your Downloads folder if you don't need it, and don't send it to anyone: it lists everyone you're connected with.

How UnfollowTool handles your file

UnfollowTool is a set of web pages that analyze the export in your browser: the Instagram tool, and tools for TikTok, X and Facebook. If you want to see what it does before requesting an export, each tool has a Try with sample data button that shows results for made-up accounts. Here is what happens when you use your own file:

1. 1

   You select the ZIP (or the loose files from it). Your browser reads the ZIP's table of contents on your device. Photos, videos and other media inside it are skipped without being read.

2. 2

   Only the relevant files are opened: the follower and following lists, plus extra lists when the export includes them, for example pending follow requests on Instagram or removed friends on Facebook. On Instagram, the tool also reads your own username from the export, if it's included, so histories of different accounts stay apart.

3. 3

   The lists are compared and shown as Don't follow you back, You don't follow back and Mutual, plus the extra lists. You can search, sort and open each profile. Any unfollowing is done by you, in the app.

4. 4

   Optional history on your device. With Remember this result on this device checked (it is by default), the tool saves the account names from your lists in your browser's own storage (IndexedDB), up to five analyses per account. When you analyze a newer export later, it shows Unfollowed you and New followers since the last one. Uncheck the box and nothing from your export is stored. Delete saved history removes what was saved.

5. 5

   CSV download, if you want it. Each list can be downloaded as a CSV file. The file is created in your browser and saved like any other download, so treat it like the export itself.

Besides the optional history, the site stores three small settings in your browser: your light or dark theme, your cookie choice, and whether the "Remember" box is checked.

What the export contains also sets the limits of what any tool can show. X stores only numeric account IDs in its follower files, so the X tool shows IDs with a link to each profile, not usernames. Facebook exports contain display names only, without profile links.

What "local" doesn't mean

• You're trusting our code. The analysis runs in your browser, but the JavaScript comes from our server, and we could change it, like any website operator could. That's why we suggest the check below instead of asking you to take our word for it.
• Ads and analytics follow your cookie choice. The page loads Google Analytics and Google AdSense, and Google's consent dialog asks visitors from the EU, UK and Switzerland for permission. Without it, Google's Consent Mode keeps ad and analytics cookies off. Google's scripts run on the same page as the tool, but our code never passes your file or your results to them. You can change your choice any time under Cookie settings in the footer. Details are in the privacy policy.
• The history is tied to one browser. A private window, clearing site data, or another browser or device starts from scratch. The tool can't tell you who unfollowed you before your first saved analysis.

Check it yourself in two minutes

You don't have to trust the claim "no upload". On a computer, you can test it:

1. Open a tool page, for example the Instagram tool.
2. Open your browser's developer tools (F12, or Cmd+Option+I on a Mac) and switch to the Network tab (Chrome guide).
3. Clear the list of requests, then select your ZIP file.
4. Watch the list while the analysis runs. No request contains your file. If you accepted cookies, you may see requests from Google's scripts; they're unrelated to the file. In older browsers without built-in ZIP support, the tool downloads one helper script (jszip.min.js) from our server the first time you select a ZIP. That's a download of code, not an upload of your data.

A simpler test: load the tool page, then turn off Wi-Fi and select your ZIP. In current browsers the analysis still works, because everything it needs is already loaded. In an older browser that needs the helper script mentioned above, select a ZIP once while online, then repeat the test.

How to judge any follower tool

Whether you use our tool or another one, these questions help:

1. Does it ask for your password, or show a login page inside the app? If so, the app can access your account. Prefer tools that don't need a login.
2. Does it promise something the platform doesn't offer? Instagram doesn't show anyone who viewed their profile. An app that promises this, as InstaAgent did, can't be getting it from Instagram.
3. Does the privacy policy say what happens on its servers? Look for what is stored, for how long, and whether data is shared.
4. Can you verify the claims? A browser-based tool can be checked in the Network tab. A mobile app that logs in to your account can't be checked as easily.
5. What happens when you stop using it? With a login-based app, access remains until you revoke it. With an export-based tool, there's nothing to revoke.

For a side-by-side look at the two approaches, see tracker apps vs. data exports.

Common questions

Is it safe to give an unfollower app my Instagram password?

No. Instagram's Help Center says apps that get your login or an access token can gain complete access to your account, including your messages, and that accounts using such apps may be limited, disabled or terminated. You also can't see what the app's server does with your login afterwards.

Is logging in through a window inside the app safer than typing my password into the app?

Not necessarily. If the login page is shown in the app's own built-in browser, the app controls that browser and can technically run its own code on the page and read what it stores after you log in. A proper authorization opens Instagram itself and shows you which permissions you're granting.

Will Instagram ban me for using a follower tracker?

Instagram doesn't publish exact rules, but says accounts using such apps may be limited, disabled or terminated. Analyzing your own data export doesn't involve Instagram at all: nothing acts on your account.

How do I remove an app I already connected to Instagram?

Open your profile, tap the ☰ menu, then Website permissions and Apps and websites, and remove anything you don't recognize. Then change your password and log out of unknown sessions under Accounts Center → Password and security → Where you're logged in.

Does UnfollowTool upload my data export?

No. The ZIP is opened and compared in your browser, and the tool sends no network requests with your data. You can check this in your browser's developer tools, or by going offline after the page has loaded.

Can UnfollowTool show who unfollowed me?

Not from a single export, which only shows the current state. If "Remember this result on this device" was on at your last analysis, your next analysis in the same browser shows who left your followers list in between. Those accounts unfollowed you, or deactivated or restricted their account.

Ready to try it? Request your export with the tutorial, then open the tool for your platform.

Open the Instagram tool