Password & accounts. Updated 2026-09-13. About 5 minutes to read.
Keep your real address for banks, government and account recovery, and give every other site its own alias you can switch off the moment it leaks.
An email alias is an address that forwards to your real inbox. You give a different alias to each shop, app or newsletter. When one starts receiving spam or phishing, you know exactly who leaked or sold it, and you switch that alias off without touching anything else.
Aliases also cut the link between your accounts. Breach data and data broker files are matched on email address. If every account uses a different one, a leak at one company cannot be joined to your profile everywhere else as easily.
There are four main ways to do it, from free and instant to fully under your control. Each has a weakness, and the right choice depends on how much you want to depend on another company.
A true alias is a permanent forwarding address on a different domain from your real mailbox. Mail sent to it arrives in your inbox, and good services let you reply through it so the recipient never sees your real address.
A disposable or temporary inbox is different. Those public, short lived inboxes are fine for a one-off download, but never use them for an account. Anyone can open the inbox and reset your password.
Gmail delivers mail sent to yourname+anything@gmail.com to yourname@gmail.com. You can sign up to a shop as yourname+shopname@gmail.com and filter or track who uses it. Gmail also ignores dots in gmail.com addresses. Outlook.com supports plus addressing too.
When you use Sign in with Apple and choose Hide My Email, Apple generates a random address that forwards to you, free of charge. With an iCloud+ subscription you can also create Hide My Email addresses at any time for any site.
Prices and free limits change, so check each provider's site. If you choose a paid plan, pick one that supports your own domain, so your aliases survive if you switch provider.
If you own a domain, you can set up a catch-all so that anything@yourdomain.com reaches you. You make up a new address for every site on the spot, and you can move the domain to another mail provider without changing a single alias.
The costs are real. A catch-all attracts spam sent to random names, so you will need rules to block addresses once they leak. You must set up mail authentication records correctly or your replies land in spam. Most importantly, if you ever let the domain expire, someone else can register it and receive your password reset emails.
Set the domain to auto-renew, keep the registrar account protected with two factor authentication, and never let a domain that receives account emails lapse.
No. A temporary inbox is public and short lived, so anyone can read it. An alias is private, permanent until you switch it off, and forwards to your own inbox, so it is safe to use for real accounts.
With most alias services, yes, as long as you reply through the forwarded message so it goes back out via the alias. With Gmail plus addressing, no, because your real address is part of the alias.
Yes. Every alias service forwards to any inbox, including Gmail. You keep using Gmail as normal, and mail sent to aliases simply arrives there.
Forwarding stops and mail to those aliases is lost. That is why you keep important accounts on your real address and choose a service that supports your own domain for anything long term.
Partly. Addresses created through Sign in with Apple are free. Creating Hide My Email addresses for any site from Settings requires an iCloud+ subscription.