Email aliases: how to hide your real email address from every site you sign up for
An alias is a separate address that forwards to your real inbox. Give every site its own, and spam, leaks and phishing become much easier to spot and shut off.
By the editors of ProtectYour.com Last reviewed 7 min read
Affiliate disclosure: this guide links to Proton and Fastmail. If you sign up through those links we may earn a commission, at no extra cost to you, and that does not change what we recommend. Free options come first, and we say where a competitor is the better fit. How we make money
Key takeaways
- An email alias is an extra address that delivers to your normal inbox, so sites never see your real one.
- Plus addressing (you+shop@gmail.com) is free and instant but easy for spammers to strip back to your real address.
- Masked aliases (random addresses from Apple, Firefox Relay, SimpleLogin, DuckDuckGo and others) hide your address properly.
- Use one alias per site. If it starts getting spam, you know who leaked it, and you can switch it off.
- Do not use an alias for accounts you could never afford to lose, like your bank or Apple or Google ID, unless you trust the alias service long term.
What an email alias is
An email alias is an address that is not your main one but still delivers to your inbox. Mail to the alias lands next to everything else. You read it and reply from the same place.
The point is separation. When your real address is on every shopping account, newsletter and loyalty program, it ends up in data breaches, marketing lists and spam databases. Once it is out, you cannot take it back. An alias gives each site something disposable. If one leaks, you turn it off and your real address stays clean.
There are two broad kinds, and they protect you very differently.
Plus addressing: free, instant, and easy to undo
Gmail, Outlook.com, Fastmail, Proton Mail and many other providers support plus addressing. Add a plus sign and any word after your username, and the mail still reaches you. If your address is jane.doe@gmail.com, then jane.doe+pharmacy@gmail.com goes to the same inbox. You do not need to set anything up.
It is useful for sorting. Make a filter that labels everything sent to +pharmacy, and it is done.
As a privacy tool, it is weak:
- Your real address is right there. Anyone can delete the plus and the tag. Spammers who buy lists do this routinely.
- You cannot turn it off. If jane.doe+store@gmail.com gets spam, you can filter it to the trash, but you cannot make it bounce.
- Some sign-up forms reject the plus sign as an invalid character.
Free step: start today
Masked aliases: the real thing
A masked alias (also called a forwarding alias or relay address) is a separate, often random address like quiet.fox.7281@example-relay.com. It forwards to your inbox, and nothing in it points back to you. You can disable it at any time, and mail to it stops.
Most services also let you reply from the alias, so the shop or person you write to sees only the alias. Several plug into your browser or password manager and create a new alias right inside the sign-up form.
Masked email alias services
| Service | What you need | Free option | Worth knowing |
|---|---|---|---|
| Apple Hide My Email | An iCloud+ subscription | Sign in with Apple creates hidden addresses without iCloud+ | Built into iPhone, iPad, Mac and Safari autofill |
| Firefox Relay | A Mozilla account | Yes, with a limited number of aliases | Extensions for Firefox and Chrome; paid tier adds unlimited aliases and replies |
| SimpleLogin | Any email account | Yes, limited | Owned by Proton since 2022; open source; supports custom domains |
| Proton Pass aliases | A Proton account | Yes, limited | Creates an alias and saves the login in one step |
| Fastmail Masked Email | A paid Fastmail account | No | Integrates with 1Password and Bitwarden to fill aliases in sign-up forms |
| DuckDuckGo Email Protection | Any email account | Yes | Gives you a @duck.com address and private aliases; strips many email trackers |
| addy.io (formerly AnonAddy) | Any email account | Yes, limited | Open source; flexible for people who want custom domains and fine control |
Free tier limits change, so check each service's current plan page. For many people the best choice is the one already built into something they use. If you pay for iCloud+, Hide My Email is already there. If you are on Fastmail, Masked Email is included. DuckDuckGo's service is free and needs no new inbox.
How to use aliases well
- One alias per site. Reusing one alias across ten shops tells you very little when it leaks. Name or label each one after the site so you can recognize it later.
- Let your password manager do the work. Proton Pass, 1Password and Bitwarden can generate an alias as they generate the password, so you never type either. See our password manager guide.
- Kill aliases that go bad. When an alias starts getting spam or phishing, switch it off. If you still need that account, change its email to a fresh alias first.
- Use aliases as a phishing detector. If an "Amazon order problem" email arrives at the alias you gave a hardware store, it is fake, full stop. More on this in how to spot phishing emails.
- Watch which aliases leak. Spam to a specific alias tells you that company was breached or sold your address. That is useful to know before you give them anything else. You can also look up your real address on haveibeenpwned.com.
The catches
Your accounts now depend on the alias service
If an alias service shuts down, stops forwarding, or locks you out, every account registered to its aliases stops receiving password resets. For a pizza delivery account that is a shrug. For your bank, your health insurer, your tax account or your Apple or Google ID, it is a serious risk. Many careful people use aliases for shopping, forums and newsletters, and their real address (ideally on a domain they own) for the handful of accounts they could not stand to lose.
Services with custom domain support lessen this risk. If your aliases live on your own domain, you can point that domain at a different service later and the addresses keep working.
Replies can expose you
If you hit reply in your normal mail app instead of replying through the alias, your real address can go out. Each service handles this a little differently, so send yourself a test the first time.
Some sites block them
A few sites refuse well-known relay domains, often ones that offer free trials and want to stop repeat sign-ups. You will need your real address or a custom-domain alias there.
It is not anonymity
The alias service knows which aliases are yours, and it can be required to hand that over under legal process. An alias stops marketers and data brokers from linking your accounts. It does not hide you from a court order. If you want fewer companies holding your details in the first place, see removing your info from data broker sites.
A sensible way to start
You do not need to move every account at once. Start with new sign-ups: from today, each new account gets its own alias. Then, over a few weeks, change the address on the accounts that send you the most marketing mail.
If you are choosing a new email provider anyway, look for one with aliases built in. Fastmail includes Masked Email on its paid plans, Proton includes aliases through Pass and SimpleLogin, and iCloud+ includes Hide My Email. Our comparison of private email providers goes through the trade-offs.
Common questions
What is an email alias?
An email alias is an extra address that forwards to your main inbox. You can give it to a website instead of your real address, and turn it off later if it starts getting spam.
Is Gmail's plus addressing a real alias?
It works for sorting and for seeing who shared your address, but your real address is visible in it. Spammers can remove the plus and the tag, and you cannot switch a plus address off.
What is Hide My Email?
Hide My Email is Apple's alias feature. It creates random addresses that forward to your inbox and is included with iCloud+. Sign in with Apple can also create a hidden address for apps that support it.
Are email alias services safe to use for important accounts?
Be careful. If the alias service stops working or you lose access, you also lose password resets for those accounts. Many people use aliases for shopping and sign-ups but keep their real address for banking, government and primary Apple or Google accounts.
Your next step
If you want a paid toolAffiliate link
Proton
Best for: People who want privacy tools from one company with free tiers to start on: VPN, password manager and encrypted email.
Not for: People who live entirely inside Apple or Google and are happy with the built-in tools; some features need a paid plan.
Visit ProtonRelated guides
- Private email providers compared: Proton Mail, Tuta, Fastmail and the big free inboxesA plain comparison of the private and mainstream email services, an honest account of what "encrypted email" protects, and how to switch without losing anything.
- How to spot phishing emails and texts (and what to do if you clicked)Phishing works by making you act before you think. These are the lures that show up most, the checks that catch them, and the steps to take if one got through.
- The best password manager for you: 1Password, Bitwarden, Proton Pass and the built-ins comparedAny decent password manager beats reusing passwords. The right one depends on which devices you use, whether you want to pay, and who you share logins with.
- How to remove your info from data broker and people-search sitesPeople-search sites publish your address, phone number and relatives for anyone to find. You can remove most listings yourself for free. It takes a few hours, and it needs repeating.