Everyday Privacy
How Email Aliases Shrink Your Data Exposure
The short version
Your email address is the field that matches a breach dump, a marketing list, and a data-broker record to the same person. Giving every service its own address breaks that match. There are four ways to do it, from free plus addressing up to your own domain, and they differ mainly in how easily the alias can be stripped back to your real inbox. The honest trade-off: aliases contain future damage well, but they add deliverability quirks and a fresh way to lock yourself out of your own accounts.
Why your email address is the key to your file
Your email address is the one identifier you hand to nearly every company you deal with, which is what lets a company join its records to everyone else's. Breach dumps, ad-tech identity graphs, and people-search records all carry it. Use a different address per service and that join quietly stops working.
In advertising this is explicit. The IAB Tech Lab's guide to identity solutions describes hashed email as one of the signals passed from publishers to identity providers to build a persistent cross-site identifier now that third-party cookies are unreliable. Your address, hashed, becomes the match key.
Brokers use it too. The FTC's 2014 report on data brokers described firms holding email addresses for a large share of US consumers and appending dozens of extra attributes to them, and people-search profiles routinely list email addresses next to your name, age, and relatives. Have I Been Pwned exists for the same reason: an address is the reliable way to look a person up across hundreds of separate leaks. Aliasing pairs naturally with the wider cleanup in our guide to reducing your digital footprint.
Tier one: plus addressing, free and easily defeated
Plus addressing bolts a tag onto the address you already have, like you+hardwarestore@gmail.com, and the mail still reaches you. It costs nothing, needs no setup, and works today. Its weakness is structural: the tag sits in plain view, so anyone who wants your real mailbox can simply delete it.
Google documents the feature in its Workspace Learning Center, which explains that you can create variations of your address by adding a plus sign and any word before the @ sign, then filter on the result. Google separately notes that dots in Gmail addresses are ignored, so those variations are not distinct either.
What plus addressing is genuinely good at is attribution. If mail to you+conference2026@ starts arriving from strangers, you know which list leaked. What it cannot do is isolate you: a breach file containing that address exposes your real inbox to anyone with a text editor, and any buyer can normalise the tag away. Some signup forms also reject the plus sign outright.
Tier two: built-in relays from Apple, Mozilla, and DuckDuckGo
Relays are masking features bundled into tools you may already use. They issue an address on a domain the provider controls, forward the mail to your real inbox, and let you switch a mask off later. They are the easiest real upgrade over plus addressing, and their free tiers differ sharply in how many addresses you get.
Apple's Hide My Email is part of iCloud+. Apple's documentation says subscribers can generate unique, random addresses that forward to their personal inbox, that replies keep the personal address private, that unused addresses can be deactivated or deleted, and that you can create as many as you need. Apple also offers Hide My Email through Sign in with Apple, using the @privaterelay.appleid.com domain.
Firefox Relay describes masks as private addresses that forward to your true address. Its free tier includes five masks, a browser extension, and email tracker removal; premium adds unlimited masks, a personalised subdomain, anonymous replies, and promotional email blocking. DuckDuckGo Email Protection is free and describes itself as a forwarding service that strips multiple types of hidden email trackers and lets you create unlimited private @duck.com addresses, with replies and new messages supported.
| Service | Addresses on the free tier | Notable free feature |
|---|---|---|
| DuckDuckGo Email Protection | Unlimited private addresses | Removes hidden email trackers |
| Firefox Relay | 5 masks | Tracker removal, browser extension |
| SimpleLogin | 10 aliases | Open source, forwards to your own mailbox |
| Apple Hide My Email | Requires iCloud+ (paid) | As many addresses as you need |
Free-tier limits as published by each provider on its own site and support pages, checked July 25, 2026. Tiers change; verify before relying on a number.
Tier three: dedicated alias providers
Dedicated alias services do one job and give you more control over it: several destination mailboxes, sending as well as receiving, your own domains, and bulk management of hundreds of addresses. This is the right tier if you intend to alias everything rather than dabble, and several of the options are open source.
SimpleLogin is a product of Proton AG, registered in Switzerland, and says all of its components are open source. Its free plan is capped at ten aliases; the paid plan advertises unlimited aliases, unlimited custom domains, catch-all support, and the ability to start a new email from an alias rather than only reply.
addy.io is also fully open source. Its free plan allows unlimited standard aliases but limits shared-domain aliases, permits one recipient address, and caps monthly bandwidth; paid plans raise those limits and add custom domains and anonymous replies. Fastmail's Masked Email ships with the mail service and integrates with 1Password. Fastmail's help pages describe three states per address: active, blocked (mail goes to Trash), and deleted (mail bounces). That bounce is the cleanest version of an alias kill switch.
Tier four: a custom domain with catch-all
The highest-control option is to register a domain and route anything@yourdomain.com to a mailbox. Every service gets an address you invent on the spot, with no provider deciding what you may have. It is also the most work and the most fragile, because the whole system now rests on one renewal invoice.
The real advantage is portability. With a relay or an alias provider, your addresses live on somebody else's domain, so leaving means changing the address on every account. Own the domain and you can move mail hosts while keeping every address you handed out. Most alias providers, SimpleLogin and addy.io included, support bringing your own domain, so you can combine tier three's tooling with tier four's ownership.
The drawbacks are equally real. A catch-all collects every spam guess aimed at your domain. An unusual personal domain becomes its own fingerprint, since jane@janesmith.xyz identifies you as reliably as a real address. And if the domain lapses, whoever registers it next starts receiving your password resets.
How the four approaches compare
Choosing between the tiers is mostly a trade between effort and durability. Free options take minutes and can be undone by the other party; owned options take real setup and survive everything except your own lapsed billing. The table below lays out the differences that matter once the novelty wears off.
| Approach | Cost | Setup effort | Can be stripped? | Portability | Recovery risk |
|---|---|---|---|---|---|
| Plus addressing | Free | None | Yes, trivially | High | Low |
| Built-in relay | Free tier or bundled | Minutes | No | Low | Medium |
| Alias provider | Free tier, paid for scale | About an hour | No | Medium | Medium |
| Custom domain | Domain plus hosting | Highest | No | Highest | High if renewal lapses |
Compiled from the providers' own documentation (Google Workspace Learning Center, Apple Support, Firefox Relay, DuckDuckGo Email Protection help, SimpleLogin, addy.io, Fastmail), reviewed July 25, 2026.
What aliases genuinely protect you from
Aliases do not make you anonymous. What they do is contain damage and create evidence. Three benefits show up quickly, and none of them are available from a single shared address no matter how strong the password on it is.
A breach reveals one alias, not your identity. When a retailer is breached, the leaked address matches nothing in any other dump, which breaks the cross-referencing that makes breach data valuable. That complements the immediate steps in what to do after a data breach.
You learn who leaked or sold you. Each address has exactly one recipient, so unexpected mail names its own source. Companies that swore they never share data get caught by their own list buyers.
You get a kill switch. When an alias attracts spam or phishing, you disable it and the problem ends for good, which is not something you can do with a primary address. Unique addresses also blunt credential stuffing, because a leaked email and password pair gives an attacker no valid username to replay elsewhere.
The drawbacks people discover months later
Alias systems fail quietly rather than loudly, which is why enthusiastic writeups rarely mention these. None are reasons to avoid aliases, but all four are reasons to keep a plain mailbox alongside them and to think before aliasing anything you depend on.
Deliverability. Every alias adds a forwarding hop. Google's guidance for forwarding mail to Gmail states plainly that forwarding can affect message authentication and that forwarded messages often fail SPF authentication. Good providers mitigate this, but expect occasional delayed or misfiled mail.
Signup rejection. A minority of forms refuse plus signs, and some refuse unfamiliar or relay-associated domains. It is usually the checkout page you need most.
Account recovery. An alias sitting in the recovery field of a bank or tax account is a dependency you will not remember creating. If it stops delivering, the reset link goes nowhere.
Provider shutdown. This is not hypothetical. The privacy email service Skiff was acquired by Notion in February 2024 and wound down, with users given a migration window before Skiff addresses and its mask aliases went inactive.
How to roll this out without locking yourself out
The safe pattern is a split, not a switch. Keep one boring mailbox for the accounts that must never break, and alias everything else. Setting that up takes an afternoon and removes almost all of the risk people hit when they alias enthusiastically and then forget what they did.
- Keep an identity mailbox. Banking, tax, medical, employment, and your password manager stay on one stable address you control directly.
- Alias the rest. Shops, newsletters, apps, forums, trials, and anything that wants an address just to send a receipt.
- Record the alias with the account in your password manager entry, not in your head.
- Never make an alias your alias provider's own recovery address. That circular dependency is how people get permanently locked out.
- Export your alias list periodically, and if you use a custom domain, enable auto-renew on a card that will not expire first.
What aliases will not fix
Aliases are forward-looking. They shape what gets collected about you from today onward and do almost nothing about the records already published. Knowing where that line falls saves you from a false sense of completion after an afternoon of setup.
They do not remove people-search listings. Brokers key those profiles on your name, current and past addresses, phone numbers, and relatives from public records, so a fresh alias changes nothing about a listing that already exists. Those need opt-outs, which is what our broker removal walkthrough and the per-site opt-out guides are for. California residents can cover registered brokers in one request through the state's DROP platform.
They also do not undo breaches that already happened, and they do not touch identifiers other than email. Your phone number and your device's advertising ID keep working as match keys regardless, which is why location data buyers can profile you without ever seeing an address. Aliases are one good layer, not a substitute for removal.
See what your current address already exposes
Before you start aliasing, find out where your real address turns up: breaches, public profiles, and the brokers likely to list you. No account, nothing stored.
Frequently asked questions
Do email aliases stop data brokers from finding me?
Not on their own. People-search brokers key their profiles on your name, addresses, phone numbers, and relatives, all pulled from public records. Aliases stop new records being joined to your file, but you still have to opt out to remove what is already published.
Is plus addressing good enough for privacy?
It is good for tracing who leaked your address and bad for hiding it. The tag sits in plain view before the @ sign, so anyone can delete everything between the plus and the @ to recover your real inbox. Treat it as labeling, not protection.
What is the difference between a relay and an alias provider?
A relay is masking bundled into something you already use, such as Apple's Hide My Email, Firefox Relay, or DuckDuckGo Email Protection. A dedicated provider like SimpleLogin, addy.io, or Fastmail Masked Email is standalone, usually with more control over domains, replies, and destination mailboxes.
Will websites reject an alias address?
Some do. A minority of signup forms reject addresses containing a plus sign, and some reject unfamiliar or relay-associated domains. Keep a plain mailbox in reserve for those cases, and never alias an account you cannot afford to lose access to.
Do aliases cause emails to land in spam?
They can. Google's guidance on forwarding mail to Gmail says forwarded messages often fail SPF authentication, and every alias adds a forwarding hop. Good providers mitigate this, but occasional delayed or misfiled mail is a real cost of the approach.
What happens if my alias provider shuts down?
Every address you created there stops delivering, which can lock you out of accounts that use it for password resets. When the privacy email service Skiff was acquired by Notion in February 2024, users got a migration window before its addresses and aliases went inactive.
Is a custom domain with catch-all the safest option?
It is the most portable, because you own the namespace and can change mail providers without changing your addresses. It is also the most fragile: one lapsed renewal takes every address down at once, and an unusual personal domain becomes its own fingerprint.
Which email address should I use for banks and government accounts?
Use one stable mailbox you control directly, not an alias. Financial, medical, tax, and account-recovery mail should go somewhere that still works if an alias provider disappears or a domain renewal fails. Save aliases for shops, newsletters, and one-off signups.
Sources: Google Workspace Learning Center and Gmail Help (plus-sign variations, dots in addresses); Google's best practices for forwarding email to Gmail (forwarded mail and SPF); Apple Support (Hide My Email); relay.firefox.com; DuckDuckGo Email Protection help; simplelogin.io; addy.io; Fastmail help (Masked Email states); IAB Tech Lab, Navigating the Maze of Identity Solutions; FTC, Data Brokers: A Call for Transparency and Accountability (2014); Have I Been Pwned. Provider tiers were checked on July 25, 2026 and change without notice.