Give every site its own email alias and see exactly who leaks it

Set up a separate email alias for every site, move your accounts over, and shut down the one that leaks without touching the rest.

This guide sets you up with a separate forwarding address for every shop, app and service you use, moves your most important accounts over, and shows you what to do the day spam arrives at one of them. The setup takes about 20 minutes. Moving your existing accounts takes a few minutes per account, and you can spread that over a week.

Why bother

When you use one email address everywhere, a breach at any one site hands attackers the login name for all your other accounts. They try the leaked password elsewhere, send convincing phishing that quotes your real address, and sell the address on. If every site gets its own alias, a leak only exposes that one alias. When spam arrives at shoe-shop.x7k2@…, you know which company lost or sold it. You can switch that alias off and none of your other accounts are affected.

Before you start

Time: 20 minutes to set up, then 2 to 5 minutes per account you move.
What you need: your main email account, one alias service (Step 1 helps you choose), and ideally a password manager to keep track of which alias belongs to which site.
Checked on: 2026-10-22, using Apple's current iPhone guide (iOS 27 listed) and macOS 13 or later, plus the current DuckDuckGo Email Protection, Firefox Relay, SimpleLogin, addy.io and Bitwarden help pages. Menu names can shift slightly between versions.

Steps

1 Pick one alias service

Choose one service and stick with it, so all your aliases are in one list. Your options:

Apple Hide My Email (part of a paid iCloud+ plan). Built into Safari, Mail and Settings on iPhone, iPad and Mac, and available at icloud.com. Good if you live mostly on Apple devices.
DuckDuckGo Email Protection (free). Effectively unlimited private addresses, removes hidden email trackers, and works in the DuckDuckGo browser and extension on any platform.
SimpleLogin (by Proton). The free plan has 10 aliases and lets you reply from an alias. Premium is $36 a year with unlimited aliases.
Firefox Relay (by Mozilla). The free plan has 5 masks, which isn't enough for one per site. Premium adds unlimited masks, but when this guide was checked it showed a waitlist.
addy.io (open source). The free plan has unlimited standard aliases but only 10 MB of forwarded mail a month, and replying needs a paid plan.

The steps below show Apple and DuckDuckGo. The others work the same way through their own dashboard and browser extension.

2 Turn the service on and link it to your inbox

iPhone or iPad (Apple):

Open Settings, tap your name, then tap iCloud.
Under iCloud+ Features, tap Hide My Email.
Scroll to the bottom and check Forward To. It should show the inbox you actually read. Tap it to change it if needed.

Mac (Apple, macOS 13 or later): choose Apple menu > System Settings, click your name at the top of the sidebar, click iCloud, then click Hide My Email.

Web (Apple): go to icloud.com/icloudplus, sign in and select Hide My Email. You need iCloud+ and two-factor authentication turned on.

DuckDuckGo, iPhone or Android: open the DuckDuckGo browser, open Settings, select Email Protection and follow the prompts. You'll pick a personal Duck Address and enter the inbox that mail should be forwarded to.

DuckDuckGo, desktop: go to duckduckgo.com/email in the DuckDuckGo desktop browser or in a browser with the DuckDuckGo extension installed.

You should see an empty or short list of addresses and the real inbox they forward to. Check that inbox for a confirmation email and confirm it.