Email Privacy · 2026
See Where Your Email Was Exposed with Unique Aliases
Once dozens of websites share your primary email, it is nearly impossible to tell where spam came from. One alias per site turns each exposure into an identifiable, controllable entry point—without forcing you to change your primary email.
An email address often serves as your username, marketing identifier, and account recovery channel. When every website has the same address, one leak, sale, or abuse usually leaves you with no option but to replace your entire primary email. Forwarding aliases change the entry point: each website sees a different address, while messages still reach your primary inbox. If one entry point becomes a problem, you can disable it on its own.
One alias per site does not mean zero spam
What it really provides is attribution and control. Suppose you use the alias shop-a only at Store A, and that address later starts receiving promotions unrelated to Store A. You now have a clear lead. A single email cannot prove that the store sold your data—vendor leaks, credential stuffing, or address guessing are also possible—but you can at least identify which entry point was affected.
| Approach | Can you identify the source? | What to do after exposure |
|---|---|---|
| One primary email shared across all websites | Very difficult | Filter messages or replace the primary email |
| One alias shared across multiple websites | Only identifies a group | Disabling it affects the entire group of accounts |
| A unique alias for each website | Relatively clear | Replace or disable just one entry point |
| One-time inbox | Best for one-off tasks | Ends when it expires; usually cannot be recovered |
Separate short-term inboxes from long-term accounts
Not every signup deserves a long-term alias. If you are downloading a file or testing a low-stakes feature and will not need access again, use aone-time inbox. Shopping, subscriptions, communities, and software accounts may later send receipts or password resets, so they are better suited to forwarding aliases.
Boundary principle: For banking, healthcare, government services, and accounts tied to your core identity, use an address you can control long term and that meets the provider’s requirements. Email privacy tools do not replace account recovery planning or multifactor authentication.
Ask yourself two questions: Will I still need these emails six months from now? If this address stops working, could I lose the account? If the answer to either is yes, do not use a short-term inbox as a long-term identity.
Create names that are recognizable without revealing personal information
A good name lets you identify its purpose at a glance in your dashboard without including your name, birth year, phone number, or password hints. Try an internal label such as “category + site abbreviation + year”—for example, “shopping / store / 26.” If the service generates random addresses, put readable information in the dashboard note instead of forcing the address itself to be readable.
Three recommended rules
- Consistent: Use the same order for similar websites instead of switching between the brand and the purpose.
- Minimal: Record only what you need to identify the account; never store passwords, verification codes, or identity documents.
- No reuse: Bind each alias to one site only, even when two sites belong to the same company.
Do not put overly sensitive labels such as “bank” or “salary” in an alias; they may appear in email headers or support tickets. Keep your internal log descriptive, but make public addresses as neutral as possible.
Create a minimal account log
Once you have many aliases, memory alone is not enough. You do not need a complex system: a protected spreadsheet or a note in your password manager will do. Keep just these five columns:
| Field | What to record | Why it matters |
|---|---|---|
| Website | The service’s official name and domain | Avoids lookalike scams and memory errors |
| Alias label | A searchable name used in the dashboard | Helps you quickly identify the source of unusual mail |
| Created | The date the address was first assigned | Helps estimate the exposure window |
| Purpose | Shopping, community, subscriptions, and more | Helps determine whether it can be disabled |
| Status | Active, pending migration, disabled | Prevents accidental deletion of an entry you still need for recovery |
Never put passwords in a regular spreadsheet. If you use a password manager, link each alias to its corresponding login item, but still generate a unique password for every site and enable multifactor authentication for important accounts.
What to do when an alias receives spam
- Verify the recipient first. Check which alias the message was actually delivered to; do not rely only on the display name.
- Keep minimal evidence. Record the date, sender domain, and subject; do not click suspicious links other than a legitimate unsubscribe link.
- Assess the account’s importance. If you still need the site, change the address to a new alias in your account settings and complete verification.
- Confirm the migration. Use the new address for a login or password-reset test to confirm that account recovery works.
- Disable the old entry last. Do not disable it first and then realize the account still depends on it.
Note: Stopping forwarding blocks future messages, but it does not delete data the other party has already stored. To exercise your deletion or unsubscribe rights, submit a request through the original site’s privacy settings or official contact channel.
If you simply forgot to cancel a legitimate subscription, use the unsubscribe link in a trusted email or the site’s account settings. If the message is clearly spoofed, do not click its links; open the original site manually in your browser and check your account security there.
Spend ten minutes reviewing aliases each quarter
An alias system is valuable only when you maintain it. Every three months, review entries in three categories: “no mail for a long time,” “account closed,” and “unusual increase.” For closed accounts, confirm data deletion and the end of any recovery period before disabling the alias. For accounts that still matter but send too much marketing, adjust notification preferences first.
- Remove duplicate or unidentifiable notes from the log and standardize the naming format.
- Check that important accounts can still be recovered through their current aliases.
- Cancel subscriptions you no longer need instead of relying only on email filters.
- Change the password for accounts linked to unusual aliases and review their login history.
The goal is not to collect as many aliases as possible, but to give every long-term entry point a clear purpose, owner, and exit plan. Start with your next new account; you do not need to migrate every old account at once.