Email Aliases: Never Give Out Your Real Address Again

Most spam-fighting advice treats the symptom: unsubscribe, filter, block, repeat forever. Aliases treat the cause. Your real address only attracts spam because you've handed it to hundreds of shops, apps, and newsletters — any one of which can sell it or leak it in a breach. If each of them had gotten a unique alias instead, your real address would still be known only to actual humans, and every leak would be a one-click fix.

Why aliases beat unsubscribing

Three properties make aliases fundamentally better than cleaning up after the fact:

• Prevention instead of cure. Unsubscribing removes you from one list, after the annoyance has already started — and shady senders treat an unsubscribe click as proof your address is live. An alias means your real address was never exposed in the first place.
• An instant kill-switch per sender. A compromised alias gets disabled in one click and all mail to it stops — no arguing with an unsubscribe page, no filter arms race. Your other 200 aliases keep working.
• Breach tracing. If [email protected] starts receiving pharmacy spam, exactly one company had that address. You know who leaked or sold it — no guessing, and a useful fact when a breach notification eventually confirms it.

Built-in aliases: what your provider already offers

Gmail: +tags and dots (convenient, but weak)

Gmail delivers anything sent to [email protected] to your normal inbox, and ignores dots (your.name@ = yourname@). Great for filtering — you can auto-label everything sent to +newsletters. But as privacy protection it fails twice: your real address is plainly visible inside the alias, and spam software routinely strips the +tag before mailing the base address. Some sign-up forms also reject + outright. Use +tags for organization, not protection.

Outlook: true aliases on one account

Microsoft lets an Outlook.com account carry multiple real aliases — full, independent addresses (even fresh @outlook.com names) that share one inbox and password. Look for Add an alias under your Microsoft account's sign-in options at account.microsoft.com. Unlike +tags, an alias reveals nothing about your primary address, you can send from it, and you can remove one that turns spammy. Microsoft caps how many you can hold and how many you can add per year, so they're best for a handful of personas (work / shopping / public) rather than one per website.

iCloud+: Hide My Email

Apple's iCloud+ subscribers get Hide My Email: on-demand random addresses like [email protected] that forward to your inbox. Safari and iOS offer one automatically on sign-up forms; you can also create them in Settings → your name → iCloud → Hide My Email. Deactivating an address kills it instantly. You can reply through the alias and the recipient never sees your real address. The catch: it's tied to Apple's ecosystem and works best if you live in it. (Separately, every iCloud Mail user gets up to three classic aliases at icloud.com — see our iCloud email guide.)

Proton: addresses, +tags, and SimpleLogin built in

Proton Mail supports +tags on every plan, extra permanent addresses (including @pm.me) on paid plans, and — because Proton owns SimpleLogin — integrated hide-my-email aliases in Proton Mail and Proton Pass. Of the big providers, it's the most alias-friendly by far.

Dedicated alias services

Alias services decouple protection from your mailbox: they work in front of any inbox, including the Gmail account you already have. The main names are SimpleLogin (Proton), Firefox Relay (Mozilla), DuckDuckGo Email Protection (free @duck.com addresses), and addy.io (formerly AnonAddy, open source).

They all share the same mechanics:

1. Forwarding

   You generate an alias — random or named — and the service relays anything sent to it on to your real address. The sender only ever sees the alias. Most offer a browser extension that fills a fresh alias into any sign-up form.

2. Replying via reverse aliases

   When you hit reply in your normal mailbox, the service rewrites the outgoing message so it appears to come from the alias, not from you. Two-way conversations work without the other side ever learning your real address.

3. Per-alias controls

   Each alias has its own on/off switch and activity log. Free tiers typically limit the number of aliases or replying; paid tiers (a few dollars a month) are effectively unlimited and add custom domains.

A practical alias strategy

• Real address: humans only — friends, family, employer. It goes on no website form, ever.
• One alias per category for low-stakes stuff: shopping@, newsletters@, forums@. Cheap to manage, decent tracing.
• One alias per sender for anything that matters or that you distrust: the random-alias-per-signup pattern that Hide My Email and SimpleLogin's extensions automate. Maximum tracing, perfect kill-switch granularity.
• When an alias turns spammy: disable it. That's the whole procedure. If the account behind it still matters, log in, change the email to a new alias, then disable the old one.

The power-user option: a custom-domain catch-all

Own yourdomain.com and enable a catch-all mailbox, and every possible address at the domain — [email protected], [email protected] — just works, invented on the spot with no service in the middle. You get unlimited aliases and total portability: switch email providers and your addresses come with you.

The trade-off is linkability. Every alias visibly shares your domain, so any two databases containing *@yourdomain.com addresses can be joined into one profile of you — the opposite of what random aliases achieve. Domain registration details can also trace back to you personally (use WHOIS privacy). A catch-all is the best tool for owning your email identity long-term; random masked aliases are the best tool for staying unlinkable. Plenty of people run both.

Frequently asked questions