Secondary email: how to use aliases and a backup address properly
Password & accounts. Updated 2026-09-13. About 4 minutes to read.
Use aliases for shopping and sign-ups, keep one real mailbox for banks, government and your password manager, and make sure its recovery email is a separate account only you control.
A secondary email can mean two different things. One is a second inbox you use for sign-ups and newsletters. The other is an alias, a forwarding address that sends mail to your real inbox without revealing it. Aliases are usually the better tool, because you can switch one off the moment it starts receiving spam.
The most important secondary address is the one people forget: the recovery email on your main account. This guide shows how to set up aliases, which services ask for a phone number, and which accounts should never use an alias at all.
Three kinds of secondary address
Plus addressing, such as yourname+shop@gmail.com: free and instant, but it still reveals your real address and spammers can strip the tag.
Forwarding aliases: unique addresses on another domain that forward to your inbox. Firefox Relay gives everyone 5 free email masks, SimpleLogin's free plan includes 10 aliases, DuckDuckGo Email Protection is free, and Apple's Hide My Email comes with iCloud+.
A second mailbox: a separate free account with its own password, used for newsletters, trials and low-value sign-ups. More to manage, but independent of your main account.
Which address to use where
Real main mailbox: banks, tax office, government services, health providers, your password manager and your phone carrier.
Separate recovery mailbox: listed only as the recovery address for your main mailbox, with its own strong password and two-factor authentication.
Aliases: online shopping, loyalty programs, newsletters, forums, dating apps, apps you are trying out, and data broker opt-out requests.
Second mailbox: services that block alias domains, or anything you expect to abandon later.
Do not use an alias as the recovery address for your main email, bank or password manager. If the alias service changes, closes or locks you out, you lose the route back into your most important accounts.
Set up an alias system in 20 minutes
Choose one alias service and create an account using your real main address, protected with two-factor authentication.
Install its browser extension or use your password manager's alias integration so you can create an alias from the sign-up form.
Create a new alias for each company, and label it with the company name.
Save the alias with the login in your password manager, so you always know which address an account uses.
Replace your real address on the ten accounts that send the most marketing email, one at a time.
Leave banking, government and password manager accounts on your real mailbox.
Which services ask for a phone number or ID
None of the common personal email or alias services require government ID. Alias services generally need only an existing email address to create an account, though Apple's Hide My Email needs an Apple Account with an iCloud+ subscription.
Free mailboxes from large providers, such as Gmail and Outlook, may ask for a phone number during sign-up or later to verify you are a person. If you want a second mailbox without linking your real number, use a second number rather than your main mobile, or choose a provider that verifies another way.
Your recovery email: the backup that decides everything
Open the security settings on your main email and look at the recovery email and recovery phone.
Remove any address that belongs to a partner, a former employer, a school or an account you no longer use.
Add a recovery mailbox that only you control, with its own unique password and two-factor authentication.
Sign in to the recovery mailbox at least every few months so the provider does not close it for inactivity.
Write down backup codes for both accounts and store them somewhere safe offline.
When an alias starts getting spam
Because each alias is unique, spam on one tells you which company leaked, sold or lost your address. Disable or delete that alias and the spam stops instantly. Then sign in to the company's account, change the email to a new alias, and check whether that company has reported a data breach.
If the account held a password you reused anywhere, change it everywhere. An alias protects your inbox, not a reused password.
What an alias does not protect
Your name, address and phone number: a shop that has those can still link the account to you.
Your password: a breach at the company exposes the password whatever the email address, so use a unique one.
Tracking links and images: some alias services strip trackers, but many emails still record when they are opened.
Your identity from the alias service: the provider knows which real inbox each alias forwards to.
Accounts that need to reach you for years: if you cancel a paid alias plan, check what happens to existing aliases first. SimpleLogin says aliases you created keep working, but you cannot create new ones beyond the free limit.
Frequently asked questions
Is it better to have a second email account or use aliases?
For most people aliases are better, because you can create one per company and disable it instantly. A second mailbox is useful for services that block alias addresses or for sign-ups you want completely separate.
Are free email alias services safe?
Reputable services such as Firefox Relay, SimpleLogin and DuckDuckGo Email Protection are widely used. The main risk is dependence, so keep critical accounts on a real mailbox you control.
Can I reply from an alias?
Many services support replies so the recipient sees the alias, not your real address. On some free plans replying is limited, so check the plan before relying on it.
Does Gmail plus addressing hide my real email?
No. Anyone can see and remove the part after the plus sign. It helps with filtering, not privacy.
What should my recovery email be?
A separate mailbox that only you can access, protected with its own strong password and two-factor authentication. Never use a work, school or partner's address.