Is an email alias encrypted? Most people who ask this expect a yes. An alias sounds like a privacy feature, and privacy features usually come with a lock on them. In practice, an alias hides your address. It does not scramble your mail.
That difference decides whether an alias fits your situation. By the end of this guide you will know what an alias does, what it leaves exposed, when encryption can be added, and how to choose a service. It takes about ten minutes to read.
What an email alias actually is
An email alias is an address that is tied to another, real address. The official wording from addy.io is that aliases are email addresses “associated with another destination email address” [1].
Think of a mail-forwarding slot. You give a store the alias. The store sends mail to the alias. The alias passes it on to your real inbox. The store never sees the real address.
Here is why people like this setup. If the store sells your address or gets hacked, only the alias leaks. You can then switch that alias off. With addy.io, a deactivated alias silently discards any mail sent to it [1]. The spam stops, and your real address stays out of it.
That is the whole job. An alias protects your address. It is a mask, not a safe.
So is an email alias encrypted?
No, not on its own. An alias service sits in the middle of your mail. It receives each message, then forwards it to you. To forward a message, the service has to be able to handle it.
Privacy Guides says this plainly: using an aliasing service “requires trusting both your email provider and your aliasing provider with your unencrypted messages” [5]. You already trust your email provider. An alias adds a second company to that list.
Picture Jake, who signs up for a coupon site with an alias. The coupon site cannot see his real address. That is a real gain. But the alias company can still see the coupon emails as they pass through, unless encryption is turned on.
So an alias answers one question: who can learn my address? It does not answer a second question: who can read my mail?
When you can make an alias encrypted
Some services let you add encryption on top. The tool they use is called PGP (also written OpenPGP). It works with a pair of keys. The public key is the half you can share, which others use to lock a message. The private key is the half you keep secret, which unlocks it.
Here is how it works with addy.io. You add your public key to a recipient on your account. The service then uses that key to encrypt all mail forwarded to that recipient. Only you can open it, using your private key [1].
addy.io describes the goal as preventing “inbox snooping” [3]. Attachments are covered too. The FAQ says they are part of the email body and are encrypted when you have the feature on [3].
SimpleLogin also offers PGP encryption. It sits on the Premium plan [4].
There is a useful side effect here. Privacy Guides says automatic PGP encryption “reduces the number of parties you need to trust from two to one” [5]. The message is locked before it reaches your final mailbox provider. Your mailbox provider then holds a scrambled copy and cannot read it.
What this costs you
Encryption is not free in effort. You need to create a key pair and keep the private key safe. If you lose it, those messages are gone for good. Mail clients also vary in how well they open encrypted messages. Many people find it fiddly.
For most readers, that effort is too much for a store receipt. It makes sense for a narrow set of mail: a source talking to a journalist, a person dealing with a sensitive medical or legal matter, or anyone who truly does not want a mail company reading their messages.
What happens when you reply
Replying is where people worry about leaking their real address. You write from your normal inbox, but the other person should only see the alias.
addy.io says that when you reply to a forwarded email, the recipient will not see your real address. The message looks as if it came from the service instead [3].
There is one catch for people who use PGP. addy.io removes any attached public keys and signatures when you reply or send from an alias [3]. That is good for your privacy, since a key could point back to you. But it means the other person will not get your key from that message.
How Apple’s Hide My Email compares
If you use an iPhone, you may already have an alias tool. Hide My Email is included with an iCloud+ subscription [2].
Apple makes two promises about your mail. It says it does not read or process the content of messages that pass through Hide My Email, apart from standard spam filtering [2]. It also says messages are deleted from its relay servers after delivery, usually within seconds [2].
Those are promises about what Apple does, not a lock on the message. That is a fair deal for many people. You trust one large company that already holds your iCloud data, and you get a short stay for your mail on its servers. Just do not confuse it with encryption that only you can open.
What alias services store
Since the service handles your mail, it matters what it keeps. addy.io states that emails are only stored when a delivery fails, and only if you turned that option on in your account settings [3].
That is a narrow policy, and it is easy to check in your settings. Still, it is the company’s statement about its own service. You cannot verify it from the outside. This is why encryption matters for anyone with a real worry: it replaces trust with a lock.
How to choose an alias service
Pick the service by what you need, not by feature count. Here are the questions worth asking.
Do you only want to hide your address?
Then any reputable service works, including Hide My Email if you already pay for iCloud+ [2]. Make a new alias for each site. If one starts sending junk, switch it off.
Do you want to stop trackers in emails?
Some marketing emails contain tiny hidden images that tell the sender when you opened the message. These are called tracking pixels. On its Lite and Pro plans, addy.io can remove known tracking pixels from forwarded HTML emails [1].
Do you want the mail locked as well?
Look for built-in PGP support. addy.io offers it [3], and SimpleLogin offers it on Premium [4].
SimpleLogin Premium costs $36 per year, or $4 billed monthly [4]. SimpleLogin is a product of Proton AG, registered in Switzerland [4]. Whether that makes it a better fit is your call. Check who runs the service and where, and read how they describe what they store.
Common mistakes
A few mix-ups come up again and again.
- Assuming the alias protects the message. It protects your address. Without PGP, the service can read the mail as it passes through.
- Turning on encryption without backing up the private key. Lose the key and you lose the mail.
- Using one alias for everything. If you reuse it across many sites, you have rebuilt the problem of a single address that is everywhere. Make one per site.
- Treating an alias as anonymity. If you sign up with your name and pay with your card, the alias hides an address, and nothing more.
- Worrying too much. Most people only need the address mask. Encryption is for a smaller group.
What you can skip
You can skip PGP if your worry is spam and data leaks. You can skip running your own alias server too. A hosted service does the job for nearly everyone, and setting up your own takes far more work than the benefit justifies for a typical reader.
Do not feel you must pick the most locked-down option. A threat that is unlikely does not need a heavy defense.
Your next step
Pick one account you signed up for with your real address, a shopping site is a good choice. Make an alias, change the address on that account, and watch where the mail goes. If you ever need to cut it off, you can switch the alias off.
An alias keeps your address out of strangers’ hands. If you also want the contents locked, you have to add that yourself.
For the technically curious
PGP is an older standard for encrypting messages, and the research here only describes it at a high level. addy.io’s setup works at the recipient level: a public key attached to a recipient is used to encrypt everything forwarded there, and only the matching private key can decrypt it [1]. Attachments are treated as part of the message body and are encrypted too [3]. On replies, attached keys and signatures are stripped [3].