{"id":413,"date":"2026-09-22T12:06:17","date_gmt":"2026-09-22T06:36:17","guid":{"rendered":"https:\/\/emailalias.io\/blog\/?p=413"},"modified":"2026-09-22T12:49:09","modified_gmt":"2026-09-22T07:19:09","slug":"passkey-login","status":"publish","type":"post","link":"https:\/\/emailalias.io\/blog\/passkey-login\/","title":{"rendered":"Passkey Login: How to Sign In Without a Password"},"content":{"rendered":"<div class=\"post-tldr\">\n  <p class=\"post-tldr__title\">The short version<\/p>\n  <ul>\n    <li><strong>A passkey lets you sign in with your face, fingerprint, or a security key<\/strong> instead of a password \u2014 nothing to remember, nothing to type.<\/li>\n    <li><strong>It&#8217;s phishing-resistant by design.<\/strong> A passkey only works on the real EmailAlias site, so it can&#8217;t be stolen by a fake login page or leaked in a breach.<\/li>\n    <li><strong>Setup takes seconds and it&#8217;s free.<\/strong> Add a passkey from Settings while signed in, give it a name, and use it to log in from then on \u2014 alongside your existing magic link.<\/li>\n  <\/ul>\n<\/div>\n\n<p>Passkey login is the simplest and safest way to get into your account: instead of a password, you sign in with the same face scan, fingerprint, or security key you already use to unlock your device. There&#8217;s nothing to memorise, nothing to type, and \u2014 crucially \u2014 nothing a scammer can phish or a breach can leak. EmailAlias supports passkey login on every plan, for free. This guide explains what a passkey is, how passkey login works, and how to set one up and use it in a couple of minutes.<\/p>\n\n<nav class=\"post-toc\" aria-label=\"Table of contents\">\n  <h2 class=\"post-toc__title\">Table of contents<\/h2>\n  <ol class=\"post-toc__list\">\n    <li><a href=\"#what\">What a passkey is<\/a><\/li>\n    <li><a href=\"#how\">How passkey login works<\/a><\/li>\n    <li><a href=\"#setup\">How to set up passkey login<\/a><\/li>\n    <li><a href=\"#signin\">How to sign in with a passkey<\/a><\/li>\n    <li><a href=\"#vs-password\">Passkey vs password<\/a><\/li>\n    <li><a href=\"#phishing\">Why passkeys resist phishing<\/a><\/li>\n    <li><a href=\"#where\">Where passkey login works<\/a><\/li>\n    <li><a href=\"#manage\">Managing your passkeys<\/a><\/li>\n    <li><a href=\"#final-thoughts\">Final thoughts<\/a><\/li>\n    <li><a href=\"#faq\">Frequently asked questions<\/a><\/li>\n  <\/ol>\n<\/nav>\n\n<h2 id=\"what\">What a Passkey Is<\/h2>\n<p>A <a href=\"https:\/\/en.wikipedia.org\/wiki\/WebAuthn\" rel=\"noopener\" target=\"_blank\">passkey<\/a> is a modern replacement for a password. Instead of a secret string you type, it&#8217;s a pair of cryptographic keys created on your device. The private half never leaves your phone, laptop, or security key; the public half is stored by the site. To sign in, your device proves it holds the private key \u2014 and it only unlocks that key after you confirm with your face, fingerprint, or device PIN.<\/p>\n<p>In everyday terms: a passkey turns &#8220;type a password you might forget or reuse&#8221; into &#8220;confirm it&#8217;s you with a fingerprint.&#8221; It&#8217;s built on the <a href=\"https:\/\/en.wikipedia.org\/wiki\/FIDO2_Project\" rel=\"noopener\" target=\"_blank\">FIDO2 \/ WebAuthn<\/a> standard, the same technology behind passwordless sign-in at major banks and tech companies \u2014 so it&#8217;s proven, not experimental.<\/p>\n<p>It&#8217;s easy to confuse a passkey with the two-factor codes you may already use, but they&#8217;re quite different. An authenticator app or an SMS code is an <em>extra<\/em> secret layered on top of a password \u2014 one more thing to type, and one more thing that can be phished, intercepted, or relayed. A passkey isn&#8217;t a second factor bolted onto a password; it <em>replaces<\/em> the password entirely with something that can&#8217;t be typed at all. There&#8217;s no code to read out, no string to enter, and nothing to copy from one screen to another. The &#8220;something you have&#8221; (your device) and the &#8220;something you are&#8221; (your fingerprint or face) are fused into a single action, which is why a passkey manages to be both stronger than a password-plus-code setup and simpler than either part of it on its own. Understanding that distinction is the key to seeing why passkeys are treated as a genuine upgrade rather than just another login hoop.<\/p>\n<aside class=\"post-keytakeaway\"><strong>Key takeaway:<\/strong> A passkey is a password replacement based on cryptographic keys. The private key stays on your device and is unlocked by your face, fingerprint, or PIN \u2014 so there&#8217;s no secret to type, forget, reuse, or leak.<\/aside>\n\n<h2 id=\"how\">How Passkey Login Works<\/h2>\n<p>When you sign in with a passkey, EmailAlias sends your device a one-time challenge. Your device unlocks the private key \u2014 after you confirm with <a href=\"https:\/\/en.wikipedia.org\/wiki\/Biometrics\" rel=\"noopener\" target=\"_blank\">biometrics<\/a> or your PIN \u2014 and uses it to sign that challenge. EmailAlias checks the signature against the public key it has on file, and if it matches, you&#8217;re in. No password is ever sent, stored, or typed.<\/p>\n<p>What you actually experience is much simpler than that sounds: you enter your email, choose &#8220;Sign in with passkey,&#8221; and your device prompts for Face ID, Touch ID, Windows Hello, or your hardware security key. A second later, you&#8217;re signed in. The cryptography happens invisibly; on your side it&#8217;s just a quick biometric check.<\/p>\n<p>A couple of details make the design especially reassuring. Your biometric data \u2014 the actual scan of your face or fingerprint \u2014 never leaves your device and is never sent to EmailAlias; it&#8217;s used only locally to unlock the private key, so the site never sees it. And because the private key is created on your device and stays there, there&#8217;s nothing on EmailAlias&#8217;s servers that could be stolen and turned into a login. A breach of the site can leak the public keys, but a public key is useless to an attacker by design \u2014 it can verify a signature but can&#8217;t produce one. That&#8217;s the structural advantage over passwords: with a password, the thing the server stores is (a protected version of) the very secret an attacker needs, whereas with a passkey the server only ever holds the half that&#8217;s safe to be public.<\/p>\n<aside class=\"post-keytakeaway\"><strong>Key takeaway:<\/strong> Passkey login works by having your device sign a one-time challenge with a private key it unlocks via your biometrics. No password is sent or stored \u2014 on your side it&#8217;s just a Face ID, Touch ID, or security-key prompt.<\/aside>\n\n<figure class=\"wp-block-image size-large\">\n  <img data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/passkey-login-example.jpg?resize=1080%2C608&#038;ssl=1\"\n       alt=\"passkey login: a sleek keyless padlock opening with a touch beside an old keyed padlock\"\n       width=\"1080\" height=\"608\" loading=\"lazy\" decoding=\"async\" \/>\n  <figcaption>Passkey login is like a lock that opens to your touch \u2014 no key to copy, lose, or hand over.<\/figcaption>\n<\/figure>\n\n<h2 id=\"setup\">How to Set Up Passkey Login<\/h2>\n<p>You add a passkey while signed in, so start by logging in as you normally would. Then:<\/p>\n<ol>\n  <li><strong>Open Settings.<\/strong> Go to your dashboard and find the Passkeys section in Settings.<\/li>\n  <li><strong>Add a passkey.<\/strong> Click Add passkey. Your device takes over and asks you to confirm with Face ID, Touch ID, Windows Hello, or a hardware security key.<\/li>\n  <li><strong>Name it.<\/strong> Give the passkey a nickname like &#8220;iPhone&#8221; or &#8220;Work laptop&#8221; so you can tell your devices apart later. (It&#8217;s optional, but helpful once you have more than one.)<\/li>\n  <li><strong>Done.<\/strong> The passkey is registered to your account and ready to use the next time you sign in.<\/li>\n<\/ol>\n<p>That&#8217;s the whole setup \u2014 no password to choose, no recovery codes to print. You can repeat it on each device you use, up to five passkeys per account, so your phone and laptop can each have their own. It&#8217;s a free feature on every plan, and it sits alongside the account you already created; if you haven&#8217;t set one up yet, our guide on <a href=\"https:\/\/emailalias.io\/blog\/how-to-create-an-email-alias\/\" rel=\"noopener\" target=\"_blank\">creating and managing aliases<\/a> covers getting started.<\/p>\n<aside class=\"post-keytakeaway\"><strong>Key takeaway:<\/strong> To set up passkey login, sign in, open the Passkeys section in Settings, click Add passkey, confirm with your device, and give it a name. You can add one on each device, up to five per account \u2014 all free.<\/aside>\n\n<h2 id=\"signin\">How to Sign In With a Passkey<\/h2>\n<p>Once you&#8217;ve registered a passkey, signing in is quick:<\/p>\n<ol>\n  <li><strong>Enter your email<\/strong> on the login page.<\/li>\n  <li><strong>Choose &#8220;Sign in with passkey.&#8221;<\/strong> This button appears when your browser supports passkeys.<\/li>\n  <li><strong>Confirm it&#8217;s you.<\/strong> Your device prompts for your face, fingerprint, or security key.<\/li>\n  <li><strong>You&#8217;re in.<\/strong> No password, no code from an email \u2014 just the biometric check.<\/li>\n<\/ol>\n<p>Your existing sign-in options don&#8217;t go away. A passkey <em>supplements<\/em> your other methods, so you can still use a magic link (the login link sent to your email) or a password if you set one. If you&#8217;re ever on a device without your passkey, you fall back to the magic link. Passkeys simply make the everyday case \u2014 signing in on your own phone or laptop \u2014 faster and safer.<\/p>\n<aside class=\"post-keytakeaway\"><strong>Key takeaway:<\/strong> To sign in, enter your email, choose &#8220;Sign in with passkey,&#8221; and confirm with your device. Your magic link and password still work too, so you always have a fallback on a device without your passkey.<\/aside>\n\n<h2 id=\"vs-password\">Passkey vs Password<\/h2>\n<p>Passkeys fix the fundamental weaknesses of passwords. Here&#8217;s how they compare.<\/p>\n\n<figure class=\"wp-block-table\"><table><caption>Passkey login vs a password \u2014 how they differ on security and convenience<\/caption>\n  <thead>\n    <tr><th><\/th><th>Passkey<\/th><th>Password<\/th><\/tr>\n  <\/thead>\n  <tbody>\n    <tr><td>Can be phished?<\/td><td>No \u2014 tied to the real site<\/td><td>Yes<\/td><\/tr>\n    <tr><td>Can leak in a breach?<\/td><td>No secret to steal<\/td><td>Yes<\/td><\/tr>\n    <tr><td>Can be reused \/ guessed?<\/td><td>No<\/td><td>Yes<\/td><\/tr>\n    <tr><td>Need to remember it?<\/td><td>No<\/td><td>Yes<\/td><\/tr>\n    <tr><td>Sign-in step<\/td><td>Face \/ fingerprint \/ key<\/td><td>Type it out<\/td><\/tr>\n  <\/tbody>\n<\/table><\/figure>\n\n<p>The pattern is clear: everything that makes passwords risky \u2014 they can be phished, leaked, reused, and forgotten \u2014 simply doesn&#8217;t apply to a passkey, because there&#8217;s no shared secret to steal in the first place. And it&#8217;s more convenient on top of being safer, which is a rare combination in security.<\/p>\n<aside class=\"post-keytakeaway\"><strong>Key takeaway:<\/strong> A passkey can&#8217;t be phished, leaked, reused, or forgotten, because there&#8217;s no shared secret \u2014 and it&#8217;s faster to use than typing a password. It&#8217;s more secure and more convenient at the same time.<\/aside>\n\n<h2 id=\"phishing\">Why Passkeys Resist Phishing<\/h2>\n<p>The single biggest advantage of a passkey is that it&#8217;s <strong>phishing-resistant<\/strong>. A passkey is cryptographically bound to the real EmailAlias domain. If you land on a convincing fake login page \u2014 the kind used in <a href=\"https:\/\/emailalias.io\/blog\/types-of-phishing-attacks\/\" rel=\"noopener\" target=\"_blank\">phishing attacks<\/a> \u2014 your passkey simply won&#8217;t work there, because the site&#8217;s identity doesn&#8217;t match. There&#8217;s no password to be tricked into typing, so the classic &#8220;enter your login on a lookalike site&#8221; scam has nothing to steal.<\/p>\n<p>This matters because phishing and <a href=\"https:\/\/emailalias.io\/blog\/what-is-email-spoofing\/\" rel=\"noopener\" target=\"_blank\">spoofing<\/a> are how most account takeovers actually happen \u2014 not by cracking encryption, but by fooling a person into handing over a password. A passkey removes the thing the attacker is after. Combined with using aliases so your login address is harder to target in the first place, it closes one of the most common doors into an account.<\/p>\n<p>It also defeats the more advanced phishing kits that can defeat ordinary two-factor codes. When you type a one-time code into a fake page, a sophisticated attacker can relay it to the real site in real time and get in anyway \u2014 the code is just another secret you can be tricked into revealing. A passkey can&#8217;t be relayed like that, because it never produces a secret you type; it signs a challenge that is bound to the genuine site&#8217;s identity, and that binding is checked by your own device. So even a pixel-perfect clone of the login page, wired straight to the real one behind the scenes, comes away with nothing. That resistance to real-time relay is what puts passkeys a clear step above passwords-plus-codes, and it&#8217;s why security teams increasingly treat them as the strongest practical option for everyday sign-in.<\/p>\n<aside class=\"post-keytakeaway\"><strong>Key takeaway:<\/strong> A passkey is bound to the real EmailAlias site, so a fake login page can&#8217;t use it \u2014 there&#8217;s no password to phish. Since most account takeovers start with phishing, this closes one of the biggest doors into your account.<\/aside>\n\n<h2 id=\"where\">Where Passkey Login Works<\/h2>\n<p>One reason passkeys have taken off is that the pieces are already in your pocket. Passkey login works anywhere you have a device that can verify it&#8217;s you \u2014 which, these days, is almost everything.<\/p>\n<ul>\n  <li><strong>Phones and tablets.<\/strong> Modern iPhones, iPads, and Android devices all support passkeys through Face ID, Touch ID, or fingerprint unlock. Your phone is usually the easiest place to create your first passkey.<\/li>\n  <li><strong>Laptops and desktops.<\/strong> Macs (Touch ID), Windows PCs (Windows Hello face or fingerprint, or a PIN), and Linux machines with a compatible authenticator all work in an up-to-date browser.<\/li>\n  <li><strong>Hardware security keys.<\/strong> A physical key (the USB or NFC kind) can hold a passkey too \u2014 a good choice for a backup or for the highest-security setups.<\/li>\n<\/ul>\n<p>On many platforms, your passkeys also sync across your own devices through your account&#8217;s keychain, so a passkey you create on your phone can be available on your laptop without setting it up twice. Because it builds on <a href=\"https:\/\/en.wikipedia.org\/wiki\/Public-key_cryptography\" rel=\"noopener\" target=\"_blank\">public-key cryptography<\/a>, the private part still never leaves your protected keychain \u2014 syncing moves it securely, it doesn&#8217;t expose it. If a device or browser doesn&#8217;t support passkeys yet, nothing breaks: you simply sign in with your magic link there instead, and use the passkey on the devices that do support it.<\/p>\n<p>It&#8217;s worth thinking of a passkey as the login equivalent of the habits that protect the rest of your email. Just as you&#8217;d avoid handing out your <a href=\"https:\/\/emailalias.io\/blog\/should-you-use-your-real-email\/\" rel=\"noopener\" target=\"_blank\">real email address<\/a> everywhere and route signups through <a href=\"https:\/\/emailalias.io\/blog\/what-is-an-email-alias\/\" rel=\"noopener\" target=\"_blank\">aliases<\/a> instead, a passkey removes the reusable secret at the front door. It sits alongside broader account hygiene \u2014 a strong, unique approach to each login rather than one password stretched across everything \u2014 and is a natural complement to <a href=\"https:\/\/en.wikipedia.org\/wiki\/Multi-factor_authentication\" rel=\"noopener\" target=\"_blank\">multi-factor authentication<\/a> thinking, except it rolls the &#8220;something you have&#8221; and &#8220;something you are&#8221; into a single tap.<\/p>\n<aside class=\"post-keytakeaway\"><strong>Key takeaway:<\/strong> Passkey login works on phones, tablets, laptops, desktops, and hardware keys, and often syncs securely across your own devices. Where a device doesn&#8217;t support it, the magic link is your fallback \u2014 so you&#8217;re always able to sign in.<\/aside>\n\n<h2 id=\"manage\">Managing Your Passkeys<\/h2>\n<p>Passkey management lives in the same Settings section where you created them:<\/p>\n<ul>\n  <li><strong>Add up to five.<\/strong> Register a separate passkey on each device you use \u2014 your phone, your laptop, a backup security key \u2014 up to five per account. Each shows its nickname and when it was last used.<\/li>\n  <li><strong>Name them clearly.<\/strong> A good nickname (&#8220;Personal iPhone&#8221;, &#8220;Work MacBook&#8221;) makes it obvious which is which, especially when it&#8217;s time to remove one.<\/li>\n  <li><strong>Remove one anytime.<\/strong> Lost a device or replaced a laptop? Delete its passkey from Settings and it can no longer be used to sign in. Your other passkeys and login methods are unaffected.<\/li>\n  <li><strong>Keep a fallback.<\/strong> Because the magic link still works, losing a device never locks you out \u2014 you can always sign in by email and re-add a passkey on your new device.<\/li>\n<\/ul>\n<aside class=\"post-keytakeaway\"><strong>Key takeaway:<\/strong> Manage passkeys in Settings: add up to five (one per device), name them clearly, and remove any you no longer use. The magic-link fallback means a lost device never locks you out.<\/aside>\n\n<h2 id=\"final-thoughts\">Final Thoughts<\/h2>\n<p>Passwords are the weakest link in almost every account \u2014 forgotten, reused, phished, and dumped in breach after breach. Passkey login sidesteps all of it: you sign in with your face or fingerprint, nothing secret is ever stored or sent, and a fake login page has nothing to steal. It takes a few seconds to set up from Settings, it&#8217;s free on <a href=\"https:\/\/emailalias.io\/pricing\/\" rel=\"noopener\" target=\"_blank\">every plan<\/a>, and your magic link stays as a backup so you&#8217;re never locked out. If you use EmailAlias to keep your email private, adding a passkey is the natural next step \u2014 it keeps the account guarding all those aliases just as private and hard to break into.<\/p>\n\n<h2 id=\"faq\">Frequently Asked Questions<\/h2>\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-q-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What is a passkey?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>A passkey is a modern replacement for a password. Instead of a secret you type, it&#8217;s a pair of cryptographic keys created on your device: the private key never leaves your phone, laptop, or security key, and the public key is stored by the site. To sign in, your device proves it holds the private key after you confirm with your face, fingerprint, or PIN. It&#8217;s built on the FIDO2\/WebAuthn standard used by major banks and tech companies.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">How does passkey login work on EmailAlias?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>When you sign in, EmailAlias sends your device a one-time challenge. Your device unlocks its private key after you confirm with Face ID, Touch ID, Windows Hello, or a hardware key, and signs the challenge; EmailAlias checks the signature against the public key on file and logs you in. No password is sent, stored, or typed. On your side it&#8217;s just entering your email, choosing &#8216;Sign in with passkey,&#8217; and passing a quick biometric check.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-3\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">How do I set up a passkey?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Sign in first, then open the Passkeys section in Settings and click Add passkey. Your device prompts you to confirm with Face ID, Touch ID, Windows Hello, or a hardware security key, and the passkey is registered to your account. You can give it a nickname like &#8216;iPhone&#8217; or &#8216;Work laptop&#8217; to tell your devices apart. Repeat on each device you use \u2014 up to five passkeys per account. It&#8217;s free on every plan.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-4\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Does a passkey replace my password and magic link?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No \u2014 it supplements them. After you add a passkey you can still sign in with a magic link (the login link emailed to you) or a password if you&#8217;ve set one. The passkey just makes the everyday case \u2014 signing in on your own device \u2014 faster and safer. Keeping the magic link as a fallback means that if you&#8217;re ever on a device without your passkey, you can still get in by email.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-5\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Why is a passkey more secure than a password?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>A passkey has no shared secret to steal. It can&#8217;t be phished, because it&#8217;s cryptographically bound to the real EmailAlias site and won&#8217;t work on a fake login page; it can&#8217;t leak in a breach, because there&#8217;s no password stored to leak; and it can&#8217;t be reused or guessed. Passwords fail on all of these \u2014 they&#8217;re phished, dumped in breaches, and reused across sites. A passkey removes the very thing attackers are trying to capture.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-6\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What happens if I lose my device?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>You won&#8217;t be locked out. Because the magic link still works, you can always sign in by email on another device and then add a new passkey there. From Settings you can also remove the lost device&#8217;s passkey so it can no longer be used, while your other passkeys and login methods keep working. This is why it&#8217;s worth registering a passkey on more than one device, and keeping your email accessible as a fallback.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-7\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">How many passkeys can I have?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Up to five per account. That lets you register a separate passkey on each device you use \u2014 for example your phone, your laptop, and a backup hardware security key \u2014 so you can sign in from any of them. Each passkey shows its nickname and when it was last used, and you can remove any of them from Settings at any time. If you reach five, delete one you no longer use before adding another.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-8\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Does passkey login cost anything?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No. Passkey login is included on every plan, including the free tier, with no extra charge. We think strong, phishing-resistant sign-in should be available to everyone, not locked behind a paywall. Premium adds other features \u2014 more aliases, custom domains, sender allow\/block lists, sending from an alias \u2014 but secure passwordless login with passkeys is free for all accounts.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>The short version A passkey lets you sign in with your face, fingerprint, or a security key instead of a password \u2014 nothing to remember, nothing to type. It&#8217;s phishing-resistant&#8230;<\/p>\n","protected":false},"author":3,"featured_media":411,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"rank_math_focus_keyword":"passkey login","rank_math_title":"Passkey Login: Passwordless, Phishing-Resistant Sign-In","rank_math_description":"Passkey login lets you sign in to EmailAlias with Face ID, Touch ID, or a security key \u2014 no password to phish or steal. Here's how to set one up.","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[13],"tags":[],"class_list":{"0":"post-413","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-features"},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/passkey-login.jpg?fit=1200%2C630&ssl=1","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":369,"url":"https:\/\/emailalias.io\/blog\/email-data-breach-what-to-do\/","url_meta":{"origin":413,"position":0},"title":"Email Security 101 (Part 2): What to Do After an Email Data Breach","author":"Troy Hunt","date":"September 15, 2026","format":false,"excerpt":"Email Security 101 \u2014 a 4-part series. \u2190 Part 1: How to Remove Yourself From Data Brokers. You're on Part 2. Part 3: Types of Phishing Attacks is now live. The short version Move fast, in order: confirm the breach, change the password on the breached account, then change that\u2026","rel":"","context":"In &quot;Security&quot;","block_context":{"text":"Security","link":"https:\/\/emailalias.io\/blog\/category\/security\/"},"img":{"alt_text":"what to do after an email data breach, shown as a forced-open mailbox with mail spilling out and a broken padlock","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/email-data-breach-what-to-do.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/email-data-breach-what-to-do.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/email-data-breach-what-to-do.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/email-data-breach-what-to-do.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/email-data-breach-what-to-do.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":400,"url":"https:\/\/emailalias.io\/blog\/email-leak-detection\/","url_meta":{"origin":413,"position":1},"title":"Email Leak Detection: How to Know When an Alias Is Exposed","author":"Troy Hunt","date":"September 21, 2026","format":false,"excerpt":"The short version Email leak detection tells you which of your addresses was exposed \u2014 not just that you were in a breach, but which service leaked or sold your details. Aliases make it work. Each alias is used with one service, so a strange sender on it is a\u2026","rel":"","context":"In &quot;Features&quot;","block_context":{"text":"Features","link":"https:\/\/emailalias.io\/blog\/category\/features\/"},"img":{"alt_text":"email leak detection, shown as a wall of brass mailboxes with one flag raised","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/email-leak-detection.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/email-leak-detection.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/email-leak-detection.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/email-leak-detection.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/email-leak-detection.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":382,"url":"https:\/\/emailalias.io\/blog\/best-email-masking-services\/","url_meta":{"origin":413,"position":2},"title":"Best Email Masking Services in 2026","author":"Troy Hunt","date":"September 18, 2026","format":false,"excerpt":"The short version Email masking hides your real address behind a separate one that forwards to your inbox \u2014 the single best defence against retailer spam, data-selling, and breaches. There's no one winner; there's a best for you. DuckDuckGo is the best free option, Apple Hide My Email suits Apple\u2026","rel":"","context":"In &quot;Comparisons&quot;","block_context":{"text":"Comparisons","link":"https:\/\/emailalias.io\/blog\/category\/comparisons\/"},"img":{"alt_text":"best email masking services in 2026, shown as a row of blank masks over envelopes","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/best-email-masking-services.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/best-email-masking-services.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/best-email-masking-services.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/best-email-masking-services.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/best-email-masking-services.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":319,"url":"https:\/\/emailalias.io\/blog\/outlook-email-aliases\/","url_meta":{"origin":413,"position":3},"title":"Outlook Email Aliases: How to Create and Use Them","author":"Troy Hunt","date":"September 3, 2026","format":false,"excerpt":"If you use Outlook.com, you can hand out more than one address without opening a second account. Outlook email aliases are extra addresses attached to a single Microsoft account, and they let you sign in and send mail from any of them while everything lands in one place. They are\u2026","rel":"","context":"In &quot;Guides &amp; How-To&quot;","block_context":{"text":"Guides &amp; How-To","link":"https:\/\/emailalias.io\/blog\/category\/guides-how-to\/"},"img":{"alt_text":"outlook email aliases feeding one Microsoft inbox","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/outlook-email-aliases.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/outlook-email-aliases.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/outlook-email-aliases.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/outlook-email-aliases.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/outlook-email-aliases.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":346,"url":"https:\/\/emailalias.io\/blog\/best-burner-email-apps\/","url_meta":{"origin":413,"position":4},"title":"Best Burner Email Apps in 2026","author":"Troy Hunt","date":"September 7, 2026","format":false,"excerpt":"The short version \"Burner email app\" means two very different things: a throwaway temp-mail inbox that self-destructs, or a permanent alias that hides your real address but keeps forwarding mail. Temp mail (Temp Mail, 10 Minute Mail, Guerrilla Mail) is only safe for one-time codes you will never need again\u2026","rel":"","context":"In &quot;Comparisons&quot;","block_context":{"text":"Comparisons","link":"https:\/\/emailalias.io\/blog\/category\/comparisons\/"},"img":{"alt_text":"choosing the best burner email app on a phone and laptop","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/best-burner-email-apps.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/best-burner-email-apps.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/best-burner-email-apps.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/best-burner-email-apps.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/best-burner-email-apps.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":99,"url":"https:\/\/emailalias.io\/blog\/should-i-use-email-alias-for-bank-account\/","url_meta":{"origin":413,"position":5},"title":"Email Alias for Bank Account: Safe or Risky?","author":"Troy Hunt","date":"May 30, 2026","format":false,"excerpt":"The short answer: yes, you can use an email alias for bank account sign-up and login \u2014 and in 2026, with phishing and credential-stuffing attacks at record levels, it's one of the cheapest privacy upgrades you can make. The long answer has caveats. Banks accept aliases far more readily than\u2026","rel":"","context":"In &quot;Security&quot;","block_context":{"text":"Security","link":"https:\/\/emailalias.io\/blog\/category\/security\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-should-i-use-email-alias-for-bank-account.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-should-i-use-email-alias-for-bank-account.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-should-i-use-email-alias-for-bank-account.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-should-i-use-email-alias-for-bank-account.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-should-i-use-email-alias-for-bank-account.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/posts\/413","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/comments?post=413"}],"version-history":[{"count":2,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/posts\/413\/revisions"}],"predecessor-version":[{"id":426,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/posts\/413\/revisions\/426"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/media\/411"}],"wp:attachment":[{"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/media?parent=413"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/categories?post=413"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/tags?post=413"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}