How Many Email Accounts Should You Have? A Simple System

How many email accounts should you have? For most people, no more than two personal ones, plus a work account that stays at work: a private mailbox for people, money, and account recovery, and, if you want one, a second mailbox whose only job is to get you back into the first. Everything else, from shops to social apps, should get its own address rather than its own inbox.

Using one email for everything is fine if you mean one inbox. Using the same address for everything is what causes trouble: it turns up in every leak, works as your username on every site, and ties your accounts together. CatchNone gives each signup its own address instead, and shows which one each message reached, on iPhone, iPad, and Mac.

How many email accounts you need: few mailboxes, many addresses

A mailbox (an account) is something you sign in to, with its own password, two-factor settings, and recovery options. An address is just where mail is sent, and one mailbox can receive at many addresses.

The recovery route can be a second mailbox you check regularly, a recovery phone number you’ll keep, or a recovery contact. So one mailbox can be enough, as long as a phone number or a trusted person can get you back into it. It just can’t recover itself (see the recovery rules).

Is it safe to use one email for everything?

One mailbox, yes. The same address for everything, no.

Separate addresses don’t change one thing: whoever gets into your mailbox can get into the rest. A hacker in your email “could request a password reset link for any of your other accounts, get the password reset link from your inbox, change your password, and lock you out,” says the FTC. That’s why the UK’s NCSC recommends a separate, strong password for your email, and why tier 1 below comes first.

What separate addresses do help with:

• One leak works everywhere. Credential stuffing replays stolen email-and-password pairs on other sites (OWASP). Unique passwords are the real fix. A unique address adds a second layer, since a leaked login no longer matches your username elsewhere (a plus address less so, because the tag can be stripped).
• Leaks are routine. Have I Been Pwned listed more than 17.8 billion breached address records in September 2026, and its FAQ notes that addresses turn up in breaches of sites people don’t remember joining.
• One address links you across services. The same address on every site makes it easy to match your accounts to each other, and the FTC warns that even hashed email addresses can still identify people.
• Phishing is harder to spot. Scam messages often claim “a problem with your account or your payment information”. If your bank knows only one of your addresses, a “bank” email at any other address is suspect from the start.

Tier 1: a private mailbox for people and critical accounts

Give this address to people and to anything that would hurt to lose: your bank and card issuers, tax and government portals, health providers, your Apple Account or Google Account, your password manager, and the registrar of any domain you own. Keep it away from checkouts, forums, and newsletters.

Pick a provider you expect to stay with for many years, or a domain you’ll keep renewing. Then protect it with a password used nowhere else, a recovery route that doesn’t loop back into it, and something stronger than text-message codes: a passkey or security key where offered, otherwise an authenticator app. The FTC says an app is “safer because the passcode isn’t susceptible to a SIM card swap attack or to someone hacking your email.” An Apple Account shows its codes on your trusted Apple devices instead, and also accepts security keys.

If that address is on a domain you own, give the domain’s registrar a different address, such as your second mailbox, or a lapsed domain takes the registrar’s reset link with it. And keep the mailbox from filling up: when a free Google account’s 15 GB (as of September 2026) runs out, “Messages sent to you go back to the sender”, fraud alerts included.

Should you have a separate email for banking?

No. A banking inbox you open twice a year is where a fraud alert sits unread. If you want separation, give the bank its own address on a domain you own and let it deliver into your private mailbox.

Tier 2: keep work at work

Your work account belongs to your employer. When you leave, an administrator can delete it. In Google Workspace, deleting a user deletes their Gmail messages and Drive files unless the admin transfers them first, and the user loses access to “other services associated with their account” (Google Workspace Admin Help). Employers may also monitor work systems: the UK’s data regulator tells employers that data protection law doesn’t prevent them from monitoring workers.

So don’t sign up for anything personal with a work address, and never make it the recovery address for a personal account. The same goes for a school address.

Tier 3: a separate address for everything else

Every shop, newsletter, app, game, and trial gets its own address. Mail still lands in one place, but each sender knows you by a different address. When one starts getting spam, you know which signup that address went to, and with most alias services you can switch that one off without touching the others. What an email alias is explains the mechanics.

Ways to get those addresses, as of September 2026:

If you’ll need to write back to a shop, pick an option that replies from the alias, or your reply may reveal your main address. For more services side by side, see email alias services compared.

Don’t use a public temp inbox for any account you’ll sign in to again. Mailinator’s FAQ says “All emails are public,” so anyone can request a password reset for that account and read the link. For how that differs from a private alias, see public temp inboxes versus aliases.

Another account or another address?

Another account is another mailbox, with its own password, two-factor setup, and recovery options. Another address is a new way to reach a mailbox you already have. As of September 2026, Google Workspace allows up to 30 aliases per user and says “Email aliases are not Google Accounts”: you can’t sign in with one. Microsoft lets you add more addresses to one Microsoft account and sign in with any of them, but they all belong to one account with one password.

This is where “have four accounts” advice goes wrong. Each extra mailbox is one more thing to keep alive, and providers can close idle ones. As of September 2026:

A shopping inbox you forget for two years can disappear and take the only route into those shop accounts with it.

Isn’t checking multiple inboxes a pain?

Yes, which is the best argument for addresses over mailboxes: ten aliases that deliver into one inbox are still one inbox. If you already have several mailboxes, read them in one app. On iPhone (iOS 26 and iOS 27), per Apple Support:

1. Open the Settings app.
2. Tap Apps, then tap Mail.
3. Tap Mail Accounts, then tap Add Account.
4. Enter the email address, tap Next, then enter the account information.

Classic Outlook for Windows does the same under File → Add Account (Microsoft Support).

Don’t plan on pulling everything into Gmail: POP fetching from other providers and Gmailify stopped taking new users after the first quarter of 2026 and end for everyone in January 2027 (Google). Forwarding into Gmail, the Gmail mobile app, and other mail apps still work.

What goes where: different addresses for different purposes

Should you have different emails for different things? Different addresses, yes. Separate email accounts, only for work: banking, shopping, and social media don’t need mailboxes of their own.

Gaming belongs with the accounts worth protecting: CISA lists “Gaming and streaming entertainment services” alongside email, financial services, social media, and online stores. For shops, see what to give stores that ask for your email; for newsletters, what to use as a junk email address.

Should you have a separate email for social media?

It’s optional: an alias you’ll keep works, and so does your main address. A throwaway doesn’t. The best email for social media accounts is one you’ll still read years from now, because recovery runs through it.

Instagram sends login links and security codes to the account’s email or phone. If someone changes your email, it tells you to look for a message from security@mail.instagram.com that may let you secure the account (Instagram Help). That only helps if you can still read the address it went to. Set up two-factor authentication with an authentication app too, the method Meta recommends.

Which address should be your recovery email?

A mailbox you check regularly, that isn’t the account it recovers, and that nobody else can end up owning. In practice, your second mailbox (or a recovery contact) recovers your private mailbox, and your private mailbox recovers everything else.

1. Don’t point recovery back into itself. Google says to choose “an email address you use regularly but not the one you use to sign in to your Google Account.” It also warns that a Google Voice number used as the recovery phone could lock you out, because the code would arrive inside the account you can’t open (Google). By the same logic, skip a plus address of the same Gmail or an alias that forwards into the account being recovered.
2. Use a mailbox you actually open. Providers can close idle accounts (see the table above), and Google and Proton send their warnings to the recovery email.
3. Avoid anything someone else could control or inherit: a work address, an abandoned account whose username can be recycled, or a domain you might let lapse. Once a registrar deletes an expired domain, there’s a 30-day redemption period and 5 days of pending deletion, and then anyone can register the domain (ICANN, for generic domains such as .com) and receive your reset links. The same goes for a phone number you give up: in a 2021 Princeton study, 215 of 259 numbers two US carriers offered to customers had belonged to someone else before.
4. Set it up now. “You can’t add recovery info while you’re locked out of your account,” Google says. Apple says account recovery can take “several days or longer” and Apple Support can’t shorten it (Apple).
5. Add a recovery contact (steps below). Apple’s contacts need an Apple device of their own and get no access to your account; Google makes you wait 7 days after one accepts.
6. Set up an Apple Recovery Key only if you’ll store it safely. It turns off Apple’s standard account recovery, so resetting your password then needs the key and your trusted phone number. If you can’t produce the key, Apple says, “you’ll be locked out of your account permanently”.

Set your Google recovery options (on a computer)

1. Go to your Google Account.
2. Click Security & sign-in.
3. Under “How you sign in to Google,” click Recovery email, Recovery phone, or Recovery contacts.
4. Follow the steps on the screen. A recovery contact has 7 days to accept your request.

Add an Apple Account recovery contact

1. On iPhone or iPad, go to Settings, then tap your name. On a Mac, choose Apple menu → System Settings, then click your name.
2. Tap or click Sign-In & Security, then Recovery Contacts.
3. Tap or click Add Recovery Contact, then follow the onscreen steps.

It needs two-factor authentication and iOS 15, iPadOS 15, or macOS Monterey 12 or later on all your devices, and your contact needs an Apple device running one of those too. You both need iMessage turned on and must be over 13 (the age varies by country or region) (Apple Support).

Moving to the system without breaking anything

If your current address is at a provider you’ll keep, and isn’t a work, school, or internet-provider address, keep it as your private mailbox and do steps 1, 2, and 5 (plus 3 for any critical account on another address). Otherwise do all six in order, and never delete an old address that still signs you in to something.

1. List what uses your current address. Start with your password manager. Then review the apps you signed in to with Google in your Google Account, and, on iPhone, the list at Settings → your name → Sign in with Apple (iOS 26). Search your old inbox for “welcome” and “verify your email”.
2. Secure the private mailbox: a unique password, a passkey, security key, or authenticator app (an Apple Account uses codes on your trusted devices instead), and recovery options that point outside it.
3. Move the critical accounts: your bank, government, health, and password manager logins, each in its own account settings. For your Apple Account, go to Settings → your name → Sign-In & Security, then tap your primary email address (Apple Support).
4. Move the accounts you’d hate to lose, such as social media and games, to addresses you’ll keep.
5. Give every new signup its own address. Switch old shop and newsletter accounts to aliases the next time you sign in, and let the rest fade.
6. Keep the old mailbox alive until nothing important uses it, and sign in at least once a year. Forward its mail to the new one meanwhile (Gmail on the web: Settings → See all settings → Forwarding and POP/IMAP → Add a forwarding address), so resets and bills still reach you. A closed address can’t deliver your resets, and a recycled one may deliver them to someone else.

CatchNone for tier 3

CatchNone is built for tier 3: a named alias for each shop, newsletter, or account, all read in one app, with every message badged by the alias it reached, so a leaked or sold address shows up. Remote images, including most tracking pixels, stay blocked until you load them. With Premium, the service assigns random @catchnone.com addresses, such as abcde-12345@catchnone.com, with no domain, DNS, or mailbox to set up; switch one off and senders get a bounce. On a domain you already own, the app reads that domain’s mailbox read-only from your device, with up to 10 aliases on the Free plan and no limit on Lite and Premium. CatchNone is available for iPhone, iPad, and Mac.

Tier 1 stays with your own mailbox: CatchNone is receive-only, so it never sends, replies to, or forwards mail, and it sends no notifications, so it isn’t the place for login codes. On your own domain, marking an alias as not in use is only a label; block a leaking address with a rule at your mail provider. @catchnone.com mail is kept for 30 days, and if Premium ends, new mail to those addresses is deleted on arrival until you subscribe again and open the app. So keep your bank, your Apple Account, and every recovery address on your own mailbox, and put aliases for accounts you want to keep on a domain you own.

FAQ

How many email accounts does the average person have?

There’s no reliable, current public figure; the survey numbers repeated online can’t be traced to a checkable source. The more useful question is how many mailboxes you can keep secure and active. For most people that’s one or two, plus work.

How many email addresses should you have?

As many as you have signups: one per shop, newsletter, app, or game. They all deliver into your private mailbox, so a hundred addresses add no inbox to check. Only the ones that sign you in to accounts you care about need to be on a service or domain you’ll keep.

How many email accounts is too many?

More mailboxes than you actually sign in to and secure. Each needs its own password, two-factor setup, and recovery options, and the big providers can close accounts left idle for a year or two.

Is there a limit to how many email accounts you can have?

Apple’s iPhone guide and Microsoft’s Outlook guide state no maximum number of accounts, and Google’s page on signing in to several at once gives none either. Google also doesn’t say how many accounts one phone number can verify; if several accounts share one recovery phone, losing that number affects all of them. For addresses, as of September 2026, iCloud Mail allows up to three @icloud.com aliases, Hide My Email as many as you need with iCloud+, and Google Workspace up to 30 aliases per user.

Can I use my iCloud email for everything?

As your private mailbox, yes, with CatchNone or, if you have iCloud+, Hide My Email covering signups. Make sure your Apple Account can be recovered without it: add a recovery contact and keep your trusted phone number current.

Can I change my email address for everything at once?

No. Each account has to be changed on its own, which is why the move above goes in order of importance. A personal Gmail address may itself be changeable to a new @gmail.com address, and the old one keeps receiving mail as an alternate address (Google).