Your email address is a permanent, unique identifier that ties together everything you sign up for. Every store, app, newsletter, and “download our whitepaper” form that gets it can use it to recognize you, sell it, or leak it in the next breach. And you can’t easily change it, because it’s your login for a hundred accounts. That asymmetry is the whole problem — and email aliases solve it cleanly.

What an alias actually is

An alias is a disposable, forwarding email address that lands in your real inbox. Instead of giving a store yourname@example.com, you give it netflix-x7q@yourdomain.com (or a random address from an alias service). Mail sent there forwards to your real inbox, and you can reply through it so the store never sees your real address.

The magic is that each alias is unique per site. That gives you three superpowers:

  1. Breach containment. If an alias starts getting spam or shows up in a breach, you know exactly which company leaked or sold it — the site name is right there in the address.
  2. One-click kill. Tired of a sender, or an alias got sold to spammers? Disable that single alias and the flood stops instantly, without touching your real address or any other account.
  3. Cross-site tracking breaks. Data brokers and ad networks love to match you across services by your email. Different address everywhere means there’s nothing to match on.

Two ways to do it

Option A: an alias service (easiest)

Services built for exactly this generate unlimited aliases on demand and forward to your inbox. The well-known privacy-focused ones are SimpleLogin (owned by Proton and integrated with Proton Mail), Addy.io (open source, generous free tier), and Firefox Relay (simple, made by Mozilla). Apple users get Hide My Email built into iCloud+, which is excellent and probably already paid for.

Setup takes minutes:

  1. Create an account with the service (use a strong, unique password — see the password managers guide).
  2. Install its browser extension, which offers to generate a fresh alias every time a signup form asks for email.
  3. Optionally set up reply support so you can answer emails without exposing your real address.

That’s it. From now on, every new signup gets its own alias.

Option B: a catch-all on your own domain (most durable)

If you own a domain (they’re cheap), you can enable a catch-all so that any address at your domain — spotify@yourdomain.com, dentist@yourdomain.com, anything you invent on the spot — lands in your inbox without pre-creating it. You make up the address at the moment you need it.

The advantage: you’re not dependent on any alias company staying in business, and you can move providers without changing a single alias. The trade-off: catch-alls can attract spam to guessed addresses, and setup requires a few DNS records. Most privacy-focused mail hosts (Proton, Fastmail, Tuta) walk you through it. This is the “own your identity” option and it pairs naturally with moving off Gmail.

A sensible naming scheme

Whichever route you choose, use a scheme you’ll recognize later:

  • Include the site name so a leak is self-identifying: theverge@…, chase-bank@….
  • Add a short random suffix if you want the address to be un-guessable: chase-bank-k3f9@….
  • Keep a note (your password manager is perfect for this) of which alias goes with which account, so you can audit later.

Where to use aliases — and where not to

Use a fresh alias for: online stores, newsletters, apps, forums, free trials, loyalty programs, “give us your email to read this,” conference signups — anywhere you don’t fully trust with a permanent identifier. This is 90% of the internet.

Think twice before aliasing: your bank, your government/tax accounts, your health portal, and anything where account recovery is life-or-death. For those, a stable address you’ll definitely keep is safer — you don’t want to lose access to a critical account because an alias service had an outage. Many people keep one “real but private” address (not their old Gmail everyone knows) for these few critical accounts, and aliases for everything else.

Migrating your existing accounts (optional, do it slowly)

You don’t have to re-alias hundreds of existing accounts overnight. A low-effort approach:

  • New signups: always use a fresh alias, starting today.
  • Existing accounts: when you happen to log in to update something, swap the email to an alias then. Prioritize the accounts most likely to sell or leak your data — retailers, marketing-heavy services, old forums.
  • Leave the critical few (bank, tax, health) on your stable private address.

Within a few months of “alias every new thing,” the majority of your active accounts are protected, with almost no dedicated effort.

The payoff

Once aliases are your default, three good things happen quietly over time: your real address stops appearing in breach dumps, spam becomes traceable and killable instead of a mystery flood, and the profile that data brokers try to build on your email address falls apart because there’s no single address to build it on.

It’s one of the highest-return, lowest-effort privacy habits there is. Set up a service in the next twenty minutes, then check it off in the privacy checklist.