What is masked email? This new spin on an old practice supercharges your security

Online security used to be simple. All you needed was a good password, and in the early days, you didn’t need a ton of characters to achieve that goal. Privacy also wasn’t quite as fragile as it is today. Your email wasn’t constantly being lost to yet another data breach.

But as online hackers and criminals get more sophisticated, so have recommendations for best security practices. Currently experts recommend the use of unique, random passwords (and the more characters, the better), plus two-factor authentication as a strong baseline. But you can go further—and companies on the frontlines of online security are trying to make that easier. 

One such step is called masked email. (You may also hear it referred to as email masks or email masking.) It formalizes a long-available feature known as email aliases as a privacy and security measure. A randomized email address is created to hide (aka mask) your true email address for an online account. Any correspondence sent to the masked email address gets forwarded to your actual inbox. The sender doesn’t know about the email’s final destination. They’ll only find out if you accidentally reply to a message as your main account.

The benefits are twofold. You get better privacy, because the more you use different masked email addresses (ideally, one per online account), the more you limit the potential fallout of the information leaking in a data breach. That email address won’t work on other websites as a login ID or for a password reset. Nor can someone take over the address like with an actual account. It’s just a forwarding address, and a disposable one at that.

Masked email vs email aliases

PCWorld

If you already filter your incoming email and/or guard against spam by using email aliases, masked email may sound like an empty marketing term for a familiar feature. But there is a slight difference—email masking is a narrower use of email aliases, with a particular style in how the aliases are created.

With masked email, the focus is on auto-generated random, unique identifiers. Think [email protected] or even [email protected]. You don’t need to come up with your own aliases, thus streamlining their use. The suggested aliases also completely obscure your email address, which inserting periods into your username (e.g., [email protected]) or adding a plus sign and an extra phrase (e.g. [email protected]) don’t achieve. You should also get streamlined controls to block incoming mail or disable the forwarding address if it gets flooded with unwanted email.

The result is a faster, easier way to maintain anonymity in your contact info—and for sites that default to email addresses as usernames, your login info too. With the added benefit of integration with some browsers and password managers, email masking saves time and reduces the hassles of the DIY route.

Ways you can start using masked email

PCWorld

Two common ways to get email masking is through an email provider or a dedicated service. Email providers offer the feature as an integrated part of the service. Access will likely cost you a little bit, though. At the moment, few providers offer masked email, and the well-known sites that do bundle it into paid plans (e.g., Apple iCloud+, Fastmail). That said, prices can be as low as $0.99 USD per month (iCloud+).

Dedicated services can be used with any site, main email address, browser, password manager, etc. You create an account using the email address you want to receive the forwarded email, and then create masks through the web interface or a browser extension. Some services also offer premium plans that allow sending and replying from an email mask, support larger file attachments, and generate email masks for multiple email addresses. All email masks are managed through the service, which is less convenient than with an email provider. You won’t have a single repository for your direct and forwarded email.

To really simplify the incorporation of email masking into your daily flow, choose a service that integrates with a password manager. Once you connect your email account or masking service, you’ll be able to create the email masks directly within the password manager. It eliminates the need to copy and paste the new forwarding address when saving login info. Right now, 1Password has a partnership with Fastmail, and Bitwarden just announced relationships with SimpleLogin, AnonAddy, and Firefox Relay. (When asked, Bitwarden said it intends to add more integrations over time, as well as expand them to products like Fastmail.) Apple users can use the company’s Hide My Email feature; email masks automatically save to iCloud Keychain if you actively use the latter.

Free email masking services

PCWorld

While getting masked email through an email provider usually costs money, dedicated services usually offer a free plan. They’re more limited in scope but still a great start.

AnonAddy allows you to create unlimited “standard” email masks. These are based on your AnonAddy username, however—so if you want more privacy, you can then use one of your 20 free shared domain email masks. You can send and reply from your aliases, too. The catch: You’re limited to 10MB (yes, megabytes) of bandwidth per month. The company estimates that to be roughly 140 emails max. (Start adding in attachments and that drops very, very fast.)

SimpleLogin offers 15 free forwarding addresses. There are no bandwidth limitations, and forwarded emails can be up to 25MB each. The service also allows you to send and reply email from an alias, too.

Firefox Relay lets you create just 5 free forwarding addresses, with a 10MB size limit per email and no bandwidth limitations. It’s the most stripped down of the freebie tiers, but it makes the list for a couple of reasons: It works across devices (and browsers—there’s a Chrome extension, too), and currently, upgrading to the paid tier with unlimited addresses and the ability to send email from aliases is just $1 per month. (If you’re intensely focused on privacy, consider quitting Chrome and switching to Firefox while you’re at it.)

PCWorld

Apple users also have an alternative option called Sign in with Apple. For apps and websites that allow you to sign in with your Apple ID, you get access to a limited form of Hide My Email, the company’s email masking service. Apple will generate a random forwarding email that will pass messages from the site or app to your Apple ID’s linked email address. Unlike with the version of Hide My Email that comes with iCloud+, you can’t change the generated aliases or create ones independently. Also, as a general security note, signing in with this method can carry risk, since anyone with access to your Apple account could also then access linked services and apps, too.

P.S.—Unique user IDs help online privacy and security, too

The general concept behind masked email can be applied to creating user IDs, too. For sites that ask you to create a dedicated username (e.g., randomuser1), going with a new identifier each time makes it harder for people to track you across the web. Unauthorized access to your other accounts is less likely, too, when your username and password are different for every site and app. And you can combine masked email with a unique user ID so that you’re really hard to trace.

Sounds complicated? This is why a password manager is so handy. It lets you continually level up your security with very little mental burden. Choose a paid password manager or a free one—either will both make life easy.