Email aliases: why use them and what they are

The problem: your email is already out there

Have I Been Pwned, the service that collects the addresses that ended up in data breaches, now counts more than 17.8 billion of them, stolen from more than 1,000 breached sites. That's more than two addresses for every person on Earth. So the question isn't whether your email has been exposed, but where.

You can check right now on haveibeenpwned.com: enter your email and find out which breaches it appears in.

What happens when a site is breached

When a site is breached, emails and passwords end up in lists that are sold and traded. Automated programs then try them on hundreds of other services: bank, Amazon, social networks, email. It's called credential stuffing and it works because we tend to recycle our credentials.

With the same email everywhere, the thief already has half the combination. All that's missing is the password, and it's often the same one.

What an alias is

An alias is a "front" email address that forwards everything to your real inbox. Think of it as a disposable phone number: whoever writes to you only sees the alias, never your real address. You create a different one for each service, for example netflix.x7k2@… or shoe-shop@….

What you gain:

• You find out who lost or sold your data. If the alias you used only for the shoe shop receives spam or phishing, you know exactly where it leaked from.
• You switch off spam with one click. You disable that alias and the problem disappears, without changing your main email.
• A breach stays locked in one room. If a site is breached, the thieves have an address that doesn't work anywhere else.
• You keep your online lives separate. Work, shopping, social networks and newsletters can't be linked to each other through the same email.

Anonymity isn't about hiding, it's about protecting yourself

"I have nothing to hide" is the phrase I hear most often.
But even people with nothing to hide lock their front door and don't write their bank PIN on their card.
Reducing how much of you is out there isn't suspicious: it's the seatbelt of your digital life.

Less data linked to you means fewer tailor-made scams, fewer identity thefts and fewer accounts stolen in a chain.
The most dangerous phishing is the kind that knows your name, your bank and your purchases.

An honest limit: an alias hides your address from whoever writes to you, but it doesn't make you invisible to your email provider, nor does it replace different passwords and two-factor authentication. It's an extra layer of protection, not a magic shield.

Get started in 10 minutes: Proton or Tuta

Both are European email services, encrypted and privacy-focused. Choose based on how much you want to spend and how curious you are about the subject.

The method I use: unlimited aliases for the price of three coffees a month. With Tuta Revolutionary you connect your own domain, for example mysurname.it, and create as many addresses as you want: [email protected], [email protected], [email protected].
The domain is bought separately: a .it or a .eu costs less than €20 a year.
On top of that, your email identity no longer depends on any provider: if one day you change service, your addresses stay yours.
If you're curious, write to me and I'll cover it in a dedicated article, or contact me by email for some quick advice.

The checklist to get started today:

• [ ] Check your email on haveibeenpwned.com
• [ ] Create a Proton account (free) or a Tuta account (from about €3/month)
• [ ] Create an alias for every new account you open
• [ ] Change the email of your 3 most important accounts (bank, Amazon, social) to a dedicated alias
• [ ] Turn on two-factor authentication wherever possible

You don't need to change everything today. Just start with the next account you open ;)

Sources

• Have I Been Pwned: count of compromised addresses
• Troy Hunt, "2 Billion Email Addresses Were Exposed", November 2025
• Verizon DBIR 2025, summary by Aembit
• Clusit 2026 report, summary by 01net (in Italian)
• Proton, address types and aliases
• Tuta, plans and pricing and unlimited aliases with a custom domain
• PricingSaaS, Tuta pricing