Stop Giving Companies Your Real Email—Do This Instead

You can’t increase your privacy or security without changing your habits. Using your real email address to sign into websites is one such habit—you’ve spent decades typing the same email address into every website, and you’ve made yourself vulnerable to both spammers and hackers in the process.

Thankfully, this habit is very easy to correct. You just need to use email aliases.

Spammers and Hackers Want Your Email Address

Every time you share your email address with a website or app, you are potentially exposing yourself to spammers and hackers. Websites shamelessly sell user data to advertisers, and customer emails are regularly leaked in corporate data breaches.

Spam is a nuisance, though it can also be a source of phishing attacks or other cybercrime. And while an email address is often the least scary thing to come out of a data breach, it can still lead to plenty of problems. Hackers may learn that you visit websites associated with private topics, such as medical or mental health issues. Or, they may use the data from multiple breaches to paint a picture of your identity and formulate a targeted attack.

These threats can be mitigated by using unique passwords for every account, keeping personal details close to your chest, setting up fraud alerts, and keeping an eye out for untrustworthy emails. Hiding your real email address simply creates an extra layer of protection and privacy.

Email Alias Services Keep Your Real Email Address Hidden

Instead of giving websites your real email address, you should use an email alias service to generate unique forwarding addresses. Email aliases aren’t “real” email accounts; they don’t require a special password or a lengthy setup process. Instead, you ask a client like Apple Hide My Email or Proton Mail to generate an alias with a randomized name, such as “inflamed-tomato@icloud.com.” Any message that’s sent to this alias will be forwarded to your primary email inbox, yet the sender will never know your real email address.

If a website decides to sell one of your alias addresses to advertisers, it’s no big deal. Simply disable email forwarding for that address to prevent the spam from reaching your real inbox. Of course, aliases also give you the opportunity to see which websites are selling your data. Let’s say that you use an email alias for a golfing website—if the alias is suddenly inundated by spam, it’s safe to assume that the golfing website sold your alias to advertisers.

By the way, you’re free to use an email alias for banking, utility, or other “important” accounts. Email aliases aren’t just for random websites or social media apps. Although I should note that some “important” websites will reject email aliases. (Since we’re on this topic, I also suggest using purpose-made addresses for banking and such. Doing so will create some distance between your primary email address and your most sensitive information.)

You can also send emails from an alias. And if you reply to a message that was forwarded from one of your aliases, it will be automatically filtered through the alias, preventing you from accidentally exposing your real email address.

The only problem with email aliases, as you may have already guessed, is that you’ll quickly end up with a unique email address for every website. This makes login a bit tricky, although you can solve the problem by using a password management service like 1Password or Dashlane. These services can autofill your login info into websites and help you generate unique passwords for each one of your accounts. (You should be using a password manager, even if you choose not to use email aliases.)

Email aliases also come with a certain amount of risk. If the company that’s hosting your aliases shuts down, your aliases may disappear. However, this risk is not exclusive to alias services. Any email provider, including Gmail, could shut down at some point. If you’re concerned that an email forwarding service may shut down in the future, set up SimpleLogin aliasing for a self-hosted domain.

Which Email Alias Service Should You Use?

There are several email alias services to choose from. And, aside from some differences in usability or payment structure, they all perform the same basic task.

Here’s a quick list of the best email alias services:

• Apple Hide My Email: All Apple devices have a built-in email aliasing client called Hide My Email. It’s far from the most intuitive option, but it’s free, and it automatically suggests aliases when you sign up for new websites.
• Proton Mail: Customers who pay for Proton Mail can generate an unlimited number of hide-my-email aliases from the Proton Mail Security Center, the Proton Pass app, or SimpleLogin. Proton Mail includes a ton of intuitive email-organization features that are worth checking out, too.
• AnonAddy: A popular, open-source aliasing service with free and paid options. AnonAddy also offers a browser extension, which makes on-the-fly alias generation extremely easy.
• Firefox Relay: A neat service with free and paid tiers. Firefox Relay is good for those who want a convenient web-based dashboard for managing aliases, and the top membership tiers include phone number aliasing.
• DuckDuckGo Email Protection: Available for free, DuckDuckGo Email Protection is a good option for those who regularly use DuckDuckGo’s services. And, like Firefox Relay, it includes a simple web-based dashboard.
• SimpleLogin: The best option for advanced users who need to generate aliases on a self-hosted domain. Note that SimpleLogin was recently acquired by Proton.

If you’re looking to totally overhaul your email setup and increase your privacy, Proton Mail is the best of these options. I’m constantly impressed by the email-organizing features offered by Proton Mail, and while all of these email services are plainly privacy-oriented, Proton takes things to the extreme with full end-to-end encryption across all of its products.

AnonAddy, Firefox Relay, and DuckDuckGo Email Protection are all incredibly easy to use and don’t require much setup. AnonAddy is good for those who need to regularly access aliases, while the other options are better for occasional use.

Apple Hide My Email has the benefit of being integrated with Apple products, and if you own an iPhone or Mac, you’re probably already using it. However, the interface for managing or deleting Hide My Email aliases is pretty unintuitive. I assume that this will improve with time, as Apple recently announced some huge improvements for its password management service,

When Should You Not Use Email Aliases?

You can use an email alias whenever you want. However, you should probably use your real email address when communicating with friends, family, colleagues, lawyers, government bodies, or anyone else who needs to know who they’re talking to.

If you’re worried that grandma will expose your primary email address to a bunch of spammers, then don’t give her your primary address. Make a new email address and use it exclusively for familial communications. Most email apps and services make it easy to switch between accounts on the fly, so managing an extra email account should be a trivial task.

On the same note, email aliases aren’t really designed with digital signature verification in mind. A digital signature is essentially a fingerprint for outgoing emails—it proves that the email was sent by you and was not altered during transit. (Most people have never utilized a digital signature, and some email clients don’t support the feature, so this is a niche point.)

I’d like to point out that email aliases are just one tool in your toolbox. You don’t need to use aliases all the time, and aliases will not fully protect you from spam or cybercriminals. Also, if your primary email address is your first and last name, people won’t have much trouble guessing it—now’s a good time to log into your email account, set up two-factor authentication, and come up with a unique password.