Email masks, and how they break the link between your accounts

Your email address is the thread that ties your accounts together. When you hand the same address to a shop, a newsletter, a quiz and a social network, any company that later buys or scrapes those lists can line them all up against that one address and build a single profile of you. An email mask breaks that thread. It gives each service a different, random address, so there is no shared key to join them by.

What a mask is

A mask is a forwarding address. You give a site an address like [email protected] instead of your real one, and mail sent to it lands in your normal inbox. The site only ever sees the mask. If that site sells your address or gets breached, the leaked address matches nothing else you do, because every other service has a different mask.

This is the automatic version of keeping a couple of separate email accounts. Instead of sorting services into two or three inboxes by hand, each service gets its own address and you still read everything in one place.

What a mask does not do

A mask hides who is behind an address. It does not make the message private. Mail sent to a mask passes through the mask provider's server on its way to you, so that provider can read what comes through, the same way any email provider can. Email was never built for end-to-end encryption, so this is true of plain email everywhere, not just masks. If the contents of a message need to be private, that is a job for Signal or an encrypted mailbox, not a mask.

So a mask is about breaking the link between your accounts. It is not about keeping the words in an email secret.

Use a shared domain, not your own

A mask only helps if the address gives nothing away. An address on a big shared domain used by thousands of other people, like @addy.io, tells a site nothing except that you use a mask service. An address on your own private domain does the opposite: if you are the only person on yourname.com, then [email protected] points straight back at you. Keep your own domain for the addresses you want tied to you, such as your main mailbox, and use a shared provider domain for the throwaway masks.

In addy.io specifically, when you create an alias, choose anonaddy.com or anonaddy.me as the alias domain, and never the option built from your own username. A username-based address is traceable straight back to you and defeats the whole point. Sticking to the shared domains is also the simpler path: adding your own domain to a mask service adds a verification step, where you reply to an email it sends you and it clears the reply within seconds before handing you a confirmation link.

The other rule is to never reuse a mask across sites. Reusing one mask on several sites you do not trust just rebuilds the shared thread you were trying to cut.

The pick: addy.io over SimpleLogin

The two established, open-source mask services are addy.io and SimpleLogin. Both forward mail and both can encrypt it to you with PGP. The difference is who runs them and how much they collect.

• addy.io is open source, based in the UK, self-hostable, and built to hold as little about you as possible. Its free tier is enough to try the idea: ten masks on shared domains, forwarding to one real address. Paid plans are about US$12 a year for more masks and custom domains, and about US$36 a year for the unlimited tier (prices as of September 2026).
• SimpleLogin is owned by Proton and comes bundled with a paid Proton account. It is polished and works well, and it is the easier choice if you already pay Proton. It also means one company holds more of your setup, which is the concern I set out in why I avoid Proton.

addy.io is the recommendation here for the same reason the rest of this site leans away from putting everything with one provider: it collects less, it is cheaper, and it can be run on your own server if you ever want to. The tradeoff is a slightly less polished experience than SimpleLogin's, and no ready-made bundle with a mailbox. That is a trade worth taking for a service whose whole point is to hold less of you.

Set it up inside your password manager

Bitwarden can create addy masks for you, so a new mask is one step of signing up rather than a trip to another site. Set it up once:

1. In addy.io, go to Settings, then API keys, then generate a new key. Name it "bitwarden" and generate it. Save the key it shows you into Bitwarden, in the notes of your addy.io login, in case you ever need it again.
2. In Bitwarden, open the generator, choose Username, and set the type to "Forwarded email alias". Set the service to addy.io, set the email domain to anonaddy.com or anonaddy.me, and paste in your API key.

From now on, when you sign up for something, generate the mask straight from Bitwarden without leaving it. On the free tier remember you have ten active masks to work with.

The generator setting does not sync between devices, so you set it up once per device: on your phone, your laptop and anywhere else you use Bitwarden. That is why the API key goes into your addy.io login in step one, so you can paste the same key in on each device rather than generating a new one every time.

When to use your real address, and when to use a mask

Use your real address for the services you trust and that need to know who you are: your bank, government and health services, your main personal contacts, and the mailbox on your own domain.

Use a mask for everything you do not trust: a shop, a newsletter or a quiz is the obvious case. Less obvious, and more important, are the big services you should not trust: Facebook, Instagram, Uber and the like.

Using a mask does not cost you the account. The mask forwards to your inbox like any other address, so you sign in and use the service as normal. The test is just trust: if you trust the service with an address that points back to you, use your real one, and if you do not, use a mask.

It sits alongside your normal mailbox

A mask service does not replace your inbox and does not touch your domain. The masks live on the provider's own domains and forward to whatever real address you set, so you can run addy.io in front of a Migadu, Tuta or any other mailbox without changing a thing about how that mailbox is set up.

Putting the whole thing together, one mailbox you own for the accounts that matter and a mask for everything else, is the setup I walk through in a privacy solution for email.