How to Hide Your Email Address, Situation by Situation

To hide your email address, give each site its own alias instead of your real address. Put everyone in Bcc when you email a group, and turn on the privacy settings that keep your address off public profiles, code commits, and domain records. You can’t blank out the From line of an email you send, so to write without showing your main address, send from a different one. None of this makes you anonymous (here’s what still identifies you), but it keeps your address away from people and companies that don’t need it.

For signups, CatchNone gives every shop and newsletter its own address, keeps their mail out of your main inbox, and shows which address each message reached, on iPhone, iPad, and Mac.

The steps, prices, and limits below were checked on September 25, 2026.

How to keep websites from getting your email address

Sign up with an alias: an address from a forwarding service, Hide My Email, or Sign in with Apple that passes mail on to your inbox without showing the site your real address. At a store’s checkout, in person or online, see what to give stores that ask for your email.

Once a company has your address, the FTC warns, it “might share or sell it to third parties.” Breaches spread it further: Have I Been Pwned lists more than 17 billion breached accounts across over 1,000 breaches (September 2026). With a separate address for each site, a sale or a leak reaches one address you can cut off, and the address shows which company you gave it to.

Signup methods, ranked

Ranked by how much the site learns about your real address and how easily you can cut off one sender. Prices and limits are as of September 2026.

A few rows need a note:

• CatchNone is receive-only by design: signup mail stays in its own app, away from your main inbox, and nothing is forwarded, so there’s no forwarding to break. You name each alias in the app and paste the address into the form.
• Plus addresses don’t hide your address at all. Anyone can delete the tag, and Microsoft calls them “extensions of their actual email address.” Some signup forms also reject the +. They’re still good for sorting: see plus addressing in Gmail, Outlook, and iCloud.
• Public temp inboxes are public. Mailinator lets you “check those public inboxes” by name, so anyone who types the same name can read a password-reset link sent there. GitHub, for one, won’t verify addresses from services that hand out temporary addresses that expire. More in burner email and temp inboxes.
• Sign in with Apple: turning off Forward To can apply to every app from the same developer, and Apple lists iCloud+ only for changing where these addresses forward.
• A catch-all lets you make up an address at the signup form, but every address carries your domain, so they can be tied to each other and to you. In Cloudflare Email Routing, that’s the Catch-all rule under Compute → Email Service → Email Routing → Routing Rules.
• Hide My Email needs iCloud+ and two-factor authentication. Once you have it, it also works on iCloud.com in any supported web browser, not only on Apple devices. A web-only iCloud account doesn’t include it: Apple says you first sign in to iCloud on an iPhone, iPad, Mac, or Apple Vision Pro, then upgrade to iCloud+. If an app or site offers you a “hidden” iCloud address, that’s Hide My Email. Steps and limits are in Hide My Email vs other email aliases. If its mail stops arriving, see Hide My Email not forwarding.

Which method to choose

For most people, a separate address for every signup, with that mail kept out of your main inbox. CatchNone does this: each message arrives badged with the alias it reached, so a leaked or sold address shows up, and remote images, including most tracking pixels, stay blocked until you load them. If you’d rather have a new alias filled in at the form, a forwarding service can plug into your browser or password manager, such as Bitwarden’s username generator. If you already pay for iCloud+, Hide My Email appears above the iPhone keyboard when a supporting app asks for an email. Where a site offers Sign in with Apple, choose its Hide My Email option.

To start with CatchNone:

1. Choose how to start: Use @catchnone.com (Premium, with no domain, DNS, or mailbox to set up) or Bring your own domain (a domain whose mail you can read over IMAP or JMAP; the Free plan includes up to 10 aliases).
2. At each signup form, create a new alias in the app, name it after the site, and paste the address instead of typing yours.
3. Read that mail in CatchNone, where each message shows which alias it reached.
4. If an alias starts getting spam, switch it off: on @catchnone.com, senders get a bounce. On your own domain, add a rule at your mail provider. The others keep working.

Keep a few accounts on your real address: your bank, tax and health services, and the recovery address for your main account. Mozilla says the same about its own Relay masks: “you’d want to share your true email address with your bank, your doctor, and your lawyer” (Relay FAQ).

Free options you can use today

As of September 2026:

• CatchNone’s Free plan: up to 10 aliases on a domain you own, read in their own app on iPhone, iPad, and Mac. Nothing is forwarded, and that mail never passes through CatchNone’s servers.
• DuckDuckGo Email Protection: unlimited @duck.com addresses (with a daily creation limit), trackers removed. You sign up in a DuckDuckGo browser or extension.
• SimpleLogin: 10 aliases, replies included.
• Proton Pass: 10 aliases.
• addy.io: unlimited standard aliases (all under your own username subdomain, so they can be linked to each other) and 10 shared-domain aliases that can’t be linked that way, within 10 MB of mail a month; no replies.
• Firefox Relay: Mozilla’s pages disagree. The plan table on relay.firefox.com shows 5 free masks, and its subscription terms (effective September 16, 2026) allow up to 50. Replies need Premium.
• Also free: plus addressing, and Cloudflare Email Routing if you own a domain.
• Sign in with Apple’s Hide My Email option comes with Sign in with Apple wherever a site offers it; Apple lists iCloud+ only for changing where those addresses forward.

CatchNone, which publishes this Journal, has no affiliation with these services, and no link here earns a commission. For plans and replies side by side, see email alias services compared.

Emailing a group without exposing everyone’s address

Put every recipient in Bcc and your own address in To.

Does Bcc keep email addresses private?

From the other recipients, yes. According to Gmail’s help, people in Bcc see the To and Cc recipients but not each other, and don’t see the replies when someone replies to all. Cc keeps nothing private: everyone in Cc sees every other To and Cc recipient. The email standard, RFC 5322, adds one risk: a Bcc recipient who replies to all can reveal that they got the message.

In Gmail

On a computer:

1. Click Compose.
2. In the To field, enter your own address.
3. Click Bcc and add everyone else.
4. Click Send.

In the Gmail app on Android, tap Compose at the bottom right, then fill in To and Bcc the same way (Gmail Help).

In Mail on iPhone (iOS 27)

1. Tap the Compose button.
2. Tap the To field and enter your own address.
3. Tap the Cc/Bcc field, then tap Bcc and enter everyone else (iPhone User Guide).
4. Tap the Send button.

In Mail on Mac (macOS 27)

1. In Mail, start a new message.
2. If there’s no Bcc field, click the Header Fields button in the message window’s toolbar, then choose Bcc Address Field (Mail User Guide).
3. Put your own address in To and everyone else in Bcc.
4. Click the Send button.

In Outlook

• New Outlook for Windows: in a new message, choose Options → Show fields → Show Bcc.
• Classic Outlook for Windows: if the message opens in its own window, choose Options → Bcc. In the Reading Pane, select Bcc on the ribbon (Microsoft Support).
• Outlook.com: select Bcc on the right side of the To line (Microsoft Support).

Then put your own address in To, add everyone else in Bcc, and select Send.

Meeting invites in Outlook

Outlook has no true Bcc for meeting invites. In new Outlook for Windows and Outlook on the web, choose Response options → Hide attendee list, and each attendee sees only you and themselves. Classic Outlook doesn’t have the option.

Large or sensitive mailings

• Personal Gmail blocks sending for up to 24 hours if you email more than 500 recipients at once or send more than 500 emails in a day (as of September 2026). Google suggests a Google Group instead (Gmail Help). In the Groups interface, who can see members’ addresses depends on the group’s Who can view members and Who can view member email addresses settings, and Google notes that addresses might still be visible in other Workspace apps.
• Gmail mail merge sends each recipient their own copy, up to 1,500 a day as of September 2026, but only on eligible paid Google Workspace plans (Gmail Help).
• A newsletter service sends each subscriber their own copy. Mailchimp, for one, says each message is delivered directly to each contact, so no one sees the others’ addresses.
• For anything sensitive, the UK Information Commissioner’s Office says Bcc is “not enough on its own to properly protect people’s personal information” and points to bulk email services, mail merge, or secure data transfer (ICO). In 2024 it fined the Central YMCA £7,500 after emails for people on an HIV support program went to 264 addresses in Cc instead of Bcc.

Sending without showing your main address

You can’t leave your address off an email you send: RFC 5322 makes the From field one of only two required header fields. So send from a different address. These can send:

• Hide My Email in Mail on iPhone (iCloud+): tap Compose, add one recipient and a subject, tap the From field, tap it again, then tap Hide My Email (iPhone User Guide). A new, unique address appears in From. It sends to one recipient at a time, and replies are forwarded to your real address.
• An iCloud Mail alias: up to three, and when you send from one, Apple says “your email address isn’t shown to the recipients.”
• A Fastmail Masked Email address: on the Compose screen, open the sender menu, click Show all, then choose the Masked Email address (Fastmail Help).
• Your personal Duck Address (free): to write first to sam@example.com from jane@duck.com, send from your forwarding address to sam_at_example.com_jane@duck.com. DuckDuckGo documents this only for your personal address, not the private ones you make for each site.
• A paid SimpleLogin, Proton Pass, or addy.io plan: the free SimpleLogin and Proton Pass plans let you reply from an alias, but starting a new message from one needs a paid plan.
• A second account with any provider.

Before you send, check your display name and signature, which can give your name away.

Keeping your email address off public pages

Google and LinkedIn profiles

Google says your Google Account email “might be shown to people you contact or share with” (Google Account Help). If you’d rather a document’s recipients didn’t see your main address, share it from another account.

LinkedIn shows your primary email to your direct connections by default. On the desktop site (LinkedIn Help):

1. Click the Me icon, then Settings & Privacy.
2. Click Visibility.
3. Under Visibility of your profile & network, click Email visibility and choose Only visible to me.
4. Next to Who can see or download your email address, click Change and set the toggle to No, so connections can’t export your address.

GitHub and GitLab commits

Every Git commit records an author email that anyone who can see the repository can read. On GitHub (GitHub Docs):

1. Click your profile picture in the upper-right corner, then Settings.
2. In the Access section of the sidebar, click Emails.
3. Select Keep my email addresses private.
4. Select Block command line pushes that expose my email.
5. Set Git on your computer to use your noreply address, shown on the same page.

git config --global user.email "ID+USERNAME@users.noreply.github.com"

That’s the format for accounts created after July 18, 2017. Step 5 matters because the push block checks only the most recent commit in each push. Commits made before the change keep the old address.

On GitLab, select your avatar, then Edit profile. In the Commit email list, choose Use a private email, select Update profile settings, and set that address with git config. A private profile alone doesn’t keep your commit email out of GitLab’s APIs.

Your domain’s WHOIS/RDAP record

A domain’s registration record can include your email. ICANN retired WHOIS for generic top-level domains on January 28, 2025, and RDAP replaced it. Check your own domain at lookup.icann.org.

Don’t assume your details are redacted. Under ICANN’s Registration Data Policy, in effect since August 21, 2025, registrars must redact personal data where the law requires it, and otherwise may choose to. When they redact, they must publish an email address or web form that doesn’t identify you, which still reaches the email on file.

Registering with an alias keeps your main inbox out of that channel. Pick one you’ll keep reading for as long as you own the domain, and not one on the domain itself, which stops receiving mail if the domain is suspended or lapses. If you don’t answer your registrar’s questions about your contact details for more than 15 days, it can suspend the domain.

• Cloudflare Registrar redacts for free “if permitted by the registry”; your state or province and country stay visible.
• Porkbun includes free WHOIS privacy for participating domains.
• .us domains can’t be redacted. The registry requires public contact data, so register them with an address you’re happy to publish.

Your own website

A contact form keeps your address off the page entirely. If your site runs through Cloudflare, Email Address Obfuscation is on by default and rewrites visible addresses so harvesting bots miss them. It doesn’t cover addresses inside scripts, most HTML attributes, or pages sent with Cache-Control: no-transform.

What still identifies you

An alias keeps your address from the site. It doesn’t keep your identity from the site, or from the alias service.

• Everything else you hand over. The site still sees your IP address and device, plus any card, phone number, name, or delivery address you give it.
• Matching across sites. Google’s Customer Match compares hashed email addresses uploaded by advertisers with those of Google accounts, and UID2 builds an advertising ID from an email address or phone number. A different address per site breaks that match; the same phone number or card can still link you.
• The alias service. It knows your real address, and Apple’s US law enforcement guidelines say basic customer information for Hide My Email “can be obtained with a subpoena or greater legal process.” Relays can have bugs too: a Hide My Email flaw, patched in July 2026, could expose a user’s real address in mail logs when a message to their alias was rejected as spam.
• Your replies. A reply from your main account shows your real address. Firefox Relay warns that adding a Cc or Bcc to a reply exposes it.
• Opening the mail. A remote image, such as a tracking pixel, can tell the sender when you opened a message.

Pick your method

Where CatchNone fits

CatchNone gives every shop, newsletter, and account its own address and keeps their mail in its own app, away from your main inbox. Each message shows which alias it reached, so a leaked or sold address shows up, and remote images, including most tracking pixels, stay blocked until you load them. With Premium, random @catchnone.com addresses such as abcde-12345@catchnone.com need no domain, DNS, or mailbox to set up, and when you switch one off, senders get a bounce. On a domain you own, the Free plan includes up to 10 aliases, and CatchNone reads that mail straight from your mailbox, so it never passes through CatchNone’s servers. Download CatchNone, available for iPhone, iPad, and Mac.

CatchNone is receive-only: it never sends, replies to, or forwards mail, so you answer from your usual account, which shows your real address. CatchNone’s service on Cloudflare keeps @catchnone.com mail for 30 days. If Premium ends, new mail to those addresses is deleted on arrival until you subscribe again and open the app, so keep bank and account-recovery mail on your real address or a domain you own. Like any alias, it doesn’t make you anonymous.

FAQ

What do “Masked Email” and “Hide My Email” mean?

A masked email address is an alias: a stand-in address that forwards to you without revealing your real one. Masked Email is Fastmail’s product name, Hide My Email is Apple’s, and Firefox Relay calls its aliases masks. Masking is one part of keeping your address private; the rest is Bcc, profile settings, commit emails, and domain privacy. For the kinds of alias and how each works, see what an email alias is.

Does an alias make you anonymous?

No. An alias keeps your real address from the site, but the site still sees your IP address, payment details, and anything you type, and the alias service knows your real address and can be required to disclose it. More in what still identifies you.

Does a VPN protect your email address?

No. A VPN changes the IP address a site sees, not the email address you type into its form. To keep your address from a site, give it an alias.

Can you make your email address private?

Not completely. Anyone you email sees your From address, and Google may show your account email to people you contact or share with. You can keep it off public profiles, code commits, and domain records, and give sites aliases instead.