Frequently Asked Questions

An email alias is a unique forwarding address that shields your real email. When someone sends mail to your alias, it's encrypted and forwarded to your real inbox. The sender never sees your actual email address, protecting you from spam, phishing, and data breaches.

Sign up for a free account, and you can generate your first alias instantly from the dashboard. Simply click "Create Alias," choose a label (like "shopping" or "newsletter"), and your new encrypted alias is ready to use.

No. EmailAlias works entirely in the cloud. There's nothing to install — just sign up, create aliases, and use them anywhere you'd normally enter an email address. We also offer browser extensions for one-click alias generation.

Yes. EmailAlias forwards encrypted mail to any email provider — Gmail, Outlook, ProtonMail, Yahoo, or any other inbox. Your existing workflow stays the same.

Almost nothing for the user — both deliver mail addressed to one address into a different inbox. In the email-aliasing category, "alias" usually means a service that mints unique addresses you give to specific sites, while "forwarding" refers to the underlying mechanism. So a private email alias service is a forwarding service with a built-in alias generator and lifecycle controls. The terms are used interchangeably in practice.

We use TLS 1.3 for all email transmissions in transit and AES-256 encryption for data at rest. Our zero-knowledge architecture means we never read or store the content of your emails — only encrypted metadata needed for delivery.

No. EmailAlias operates on a zero-knowledge model. We forward emails in real-time through encrypted channels and only store metadata (sender, timestamp, delivery status) for your analytics dashboard. Email content is never stored on our servers.

Zero-knowledge means we've designed our systems so that we technically cannot access your email content, even if we wanted to. Emails pass through our encrypted pipeline and are delivered to your inbox without being stored or read. We only retain minimal metadata for routing and analytics.

Yes. We are fully GDPR compliant. You can export or delete all your data at any time. We process minimal personal data, store nothing beyond what's needed for the service, and our infrastructure is designed with privacy-by-design principles.

Yes, in every jurisdiction we operate in. Email aliases are a form of mail forwarding — the same legal framework that lets you set up Gmail filters or use a P.O. box. You're allowed to give a unique address to each service you sign up for; the service has no legal claim to your underlying real address. The only legal issue arises if aliases are used to commit fraud, send harassment, or evade subpoenas — and that's true of any email tool, not just aliases.

No, and it shouldn't be assumed to. The forwarding provider knows your real address by definition — they need it to deliver mail. With a valid legal request, that mapping can be disclosed. Anonymous email forwarding makes you anonymous to senders — it's not a tool for evading lawful process. For network-level anonymity (Tor, VPN), you'd combine an alias service with those tools, but each layer is separate.

No, if the forwarding service is built correctly. The provider rewrites the message envelope so the From, Reply-To, and return-path all point at the alias domain, not your real address. Headers that could leak you (Bcc copies, X-Original-To, etc.) are stripped, and the rewritten message is DKIM-signed by the alias domain. As long as you don't mention your real address in the message body, the recipient sees only the alias.

Yes — Premium feature. When you receive a forwarded email, you can reply from your real inbox and EmailAlias routes the reply back through your alias, so the recipient only sees the alias address, never your real email. Free accounts can receive but not send; upgrade to enable replies.

Yes. Premium users can add up to 5 custom domains with full SPF, DKIM, and DMARC verification. Create professional aliases like contact@yourdomain.com while maintaining complete privacy.

Because each service has its own unique alias, you'll know exactly which service leaked your data — when spam or phishing hits that alias, the source is obvious. Our exposure intelligence engine also flags suspicious senders in real time. Disable the affected alias and your real email stays safe.

Our exposure intelligence engine scores every incoming sender on risk signals in the domain — sketchy TLDs (.xyz, .top, .gq), suspicious keywords (phish, scam, lottery, verify-account, etc.), deep subdomain nesting, and digit-heavy or hyphen-stuffed labels. A score of 50+ is considered suspicious. When an alias is hit by a high-risk sender you get an in-dashboard event plus an email heads-up — at most once per 24h on Premium, once per week (high-risk only) on Free.

Yes. Free plan only sends an email alert for high-risk events (score ≥ 50) at most once per week. Premium gets alerts for any flagged event (score ≥ 15) at the standard 24-hour cooldown. Detection itself runs identically on both plans — only the inbox-frequency differs, and every event still lands in your dashboard either way.

Yes. You can disable an alias at any time from your dashboard — disabled aliases silently reject incoming mail. You can also permanently delete aliases you no longer need.

Yes — Premium users can set a display name (the "From" label recipients see, e.g. "Sam Carter <alias@emailalias.io>") when creating an alias. Setting it on creation takes effect immediately. After that, any edit goes through a 24-hour cooldown before it goes live, and you're capped at 3 edits per rolling 24 hours per alias. Clearing the name follows the same cooldown. Names that impersonate well-known brands (PayPal, Apple, banks, etc.) are rejected.

Free users get up to 10 aliases. Premium users enjoy unlimited aliases (with a fair-use soft cap), plus custom domains, send & reply, exposure analytics, priority forwarding, and stricter spam filtering.

"Unlimited" means there's no pre-set limit designed to push you to a higher tier. For fair-use protection we apply a soft cap of 150 aliases per account — enough for a unique alias on every service most people use — and you can create up to 20 new aliases per day. If you genuinely need more, email support@emailalias.io and we'll lift the cap after a quick review. Individual aliases that exceed 100 emails/hour are auto-disabled to shield your inbox from abuse.

Aliases on a shared provider domain (e.g. @emailalias.io) aren't portable — they live on our domain and stay with us. Aliases on a custom domain (yourdomain.com) are fully portable: you keep the domain, point its MX records at a new provider, re-create the same local-parts on their side, and the addresses keep working — provided the new provider supports custom local-parts (most do; some only issue random codes). Custom domains are a Premium feature on EmailAlias, but for anyone who plans to use aliases long-term, it's vendor-independence insurance worth having.

Yes — Settings → Account → "Export your data" downloads a JSON file containing your account profile, every alias (with label, destination, display name, status), every verified custom domain (with DNS check flags), and your forwarding destinations. The button is dashboard-only — there is no programmatic export endpoint — so you stay in control of when a copy leaves your account. The export is meant for personal backup and for re-creating your aliases on another provider if you ever migrate; it does not include raw email logs or API key secrets.

Yes, via the REST API on Premium. POST /api/aliases with alias_type and label generates one alias; loop it for as many as you need. Common bulk-generation use cases: marketplace listings (one alias per ad), security testing, A/B email-flow testing, and per-customer aliases on a custom domain. The MCP server lets AI assistants like Claude Desktop and Cursor call the same endpoint conversationally.

Yes — email aliases are just regular email addresses, so any inbox app on iOS or Android receives forwarded mail with no setup. The forwarding pipeline is server-side, not client-side. The browser extension is desktop-only currently, but you can mint aliases from your phone via the dashboard at emailalias.io or via the REST API. iOS Safari extension support is on the roadmap.

Every alias includes built-in spam filtering. Free users get a baseline filter; Premium gets a stricter threshold plus per-account allow and block lists. The filter combines a curated keyword list, all-caps heuristics, and a tracking-domain blocklist — no email content is sent to a third-party model.

Premium accounts get a stricter spam-filter threshold that catches more borderline spam, plus per-account allow and block lists. Add trusted senders to your allowlist to bypass the spam filter, or add specific emails/domains to your blocklist to drop them silently. Manage everything from the Spam Filters page in your dashboard.

Simply disable the alias from your dashboard. This is the beauty of per-service aliases — you can cut off spam from one source without affecting any other service. You can also create a new alias for that service if needed.

Unlike throwaway email services, EmailAlias gives you permanent, encrypted aliases you control. You can receive mail indefinitely, reply from your alias, and disable it anytime. It's privacy without the inconvenience. Disposable emails expire and can't receive future messages — aliases are yours forever.

Yes. Our free plan includes 10 encrypted aliases, basic spam blocking, basic leak detection, and email forwarding. No credit card required.

Unlimited aliases, up to 5 custom domains, unlimited verified forwarding inboxes (so each alias can route to the right mailbox), send & reply from any alias, real-time leak detection with exposure analytics, and priority processing — all for $4/month or $35/year (save 27%).

Yes, a 7-day free trial is available for first-time subscribers. You can cancel anytime during the trial and you won't be charged. If you've subscribed in the past, the trial isn't offered again — the first payment is charged immediately.

All major credit and debit cards (Visa, Mastercard, American Express) through Stripe. Billing is handled end-to-end by Stripe — we never see or store your card details.

Yes. Cancel from your billing portal at any time. Premium features remain active until the end of your current billing period, after which your account reverts to the free plan.

See our refund policy for details. In short: the 7-day free trial gives you time to decide before any charge, and we review refund requests on a case-by-case basis.

Yes. Upgrades and changes take effect immediately via the billing portal. Yearly billing saves 27% over monthly.

Yes. All aliases — including custom domain aliases — support SPF, DKIM, and DMARC authentication. This ensures your forwarded emails have maximum deliverability and aren't flagged as spam.

Yes. We offer a RESTful API for programmatic alias management, exposure monitoring, and account management. Check our API documentation for endpoints, authentication, and usage examples.

We target 99.9% uptime for email forwarding. Our infrastructure runs on redundant cloud providers with automatic failover. Check our status page for real-time availability.

The extension self-excludes from emailalias.io itself and from password-manager domains. On a few sites, email fields are heavily obfuscated — try clicking the toolbar icon and using the popup to create an alias manually, then paste it. If it consistently fails on a popular site, email hello@emailalias.io with the URL.

No. The content script only inspects input element attributes (type, name, placeholder, label) to decide whether to show a badge. It doesn't read input values, page text, or browsing history. The API is only contacted after you explicitly click the badge, the toolbar icon, the keyboard shortcut, or the right-click menu.

No — the extension is a client for your EmailAlias account. Sign up for the free plan at emailalias.io if you don't have one yet; the free plan includes 10 aliases.

Magic link is the standard flow: enter your email in the popup, click the link in the email, and the popup picks up where you left off. Magic link works on every plan. API keys are a Premium feature: paste an ea_live_ key from your dashboard for instant sign-in across machines without the email round-trip.

Yes. The extension stores your aliases by querying your account, so signing in on a second browser (or device) gives you the same list. Local caching keeps things instant; the extension refreshes the cache automatically when it goes stale.

Press Ctrl+Shift+E (Cmd+Shift+E on Mac) on any page. The extension creates a fresh alias for the current site, copies it to your clipboard, and shows an OS notification confirming the alias text. Useful when the badge isn't showing or you want an alias before reaching the form.

Right-click anywhere on a page and pick "Create EmailAlias for this site." The extension generates an alias labeled with the current hostname and copies it to your clipboard — same outcome as the keyboard shortcut, no signup form required.

No. The free plan and basic Premium use addresses on our shared domain (@emailalias.io), no domain ownership required. Custom domains are an optional Premium feature for users who want aliases on a domain they control — useful for professional, business, or vendor-portable use cases. Most personal users never need a custom domain.

Once you paste the records into your DNS host (Cloudflare, Namecheap, Route 53, etc.) and click verify, the check is usually instant — DNS is cached aggressively at the resolver layer, but our verifier queries authoritative servers directly. If your records aren't visible immediately, propagation can take 5 minutes to a few hours depending on your DNS host. The verify button is safe to click multiple times.

Yes. mail.yourdomain.com or aliases.yourdomain.com works the same as a root domain — same MX/SPF/DKIM/DMARC setup, just on the subdomain. People do this when they want to keep their root domain's mail handling separate (e.g., main domain runs on Google Workspace, subdomain runs on the alias service). Deliverability is identical as long as the records are right.

Custom-domain support is the bar for business use — you don't want client-facing aliases on someone else's brand. EmailAlias.io, SimpleLogin, and Addy.io all support real custom domains on their paid tiers. EmailAlias.io adds suspicious-sender intelligence, AES-256 at rest, and a REST API + MCP server, which most businesses care about more than self-hosting. Firefox Relay and DuckDuckGo Email aren't great fits for business — neither supports real custom domains.

If you used a custom domain, switching is straightforward: re-create your aliases on the new provider, point your domain's MX records at their servers, and update SPF/DKIM/DMARC. Existing senders keep mailing the same addresses; only the routing changes. If you used the old provider's shared domain (e.g. @theirhost.com), those aliases die when you leave — you'd need to set up new aliases on the new provider's domain and update each site individually. Custom-domain users have vendor-independence; shared-domain users don't.