Passkal

Email Alias Generator

Make a separate email address for every shop, newsletter and sign-up form, so you can see who leaked yours. Aliases are built on your device and never leave your browser.

Handing the same address to every shop, newsletter and sign-up form is what lets them be matched up — and gives you no way to tell which one sold it on. Give each a separate alias instead: mail still reaches you, and when spam arrives, the address it was sent to names the culprit.

Your email alias

An example, so you can see the shape. Add your own address below and the alias becomes yours.

Privacyyour real address is inside itExposed

Privacy: Exposed, your real address is inside it

Where it arrives

Kind of alias

Nothing to set up: most providers already deliver anything with a + in it to the same inbox. It tells you who leaked your address, but it does not hide it.

Stays on this device, exactly like everything else here. It is only used to put the alias together.

Goes at the front of the alias so you can see at a glance where it was used. Anyone holding the alias can read it too, so keep it to the name of the site.

The alias itself

Made of

Random characters are far harder to stumble onto. Words are easier to read back over the phone, which is worth having if the alias goes on a paper form.

10
4 characters24 characters

Ten is plenty. The alias only has to be too obscure to be found by guesswork, not to survive an attack.

Separator

Goes between the label, the words and the numbers. All four are accepted by mail providers; if a sign-up form is fussy about one, running the parts together is never refused.

Recent aliases

Nothing here yet. Aliases you generate are kept on this device only, so you can look up which one you gave to whom.

How an alias helps

An alias is a second address that lands in the inbox you already have. Give a different one to each shop, each newsletter, each form that insists on an address before it will show you anything. Mail still reaches you, and every message now carries a record of where the address came from.

That record is the point. When spam turns up addressed to the alias you only ever gave to one shop, you know exactly where your address went — and you can throw that alias away without touching any of the others, or your real address.

The two kinds here are worth very different things. A plus address is the one that works this minute, with no setup: anything between the + and the @ is ignored when the message is delivered. But your real address is sitting right there in front of the +, and deleting the tag is the first thing a bulk sender does. Treat it as a label on your address, never as a disguise for it.

An alias on a domain of your own — or on a forwarding service you have an account with — is the one that actually hides you. What the shop holds cannot be turned back into your inbox, so an address that leaks or is sold on leads nowhere once you switch the alias off.

Either way this is about your address, not your account. The password is what keeps people out of your mail, so pair an alias with a strong one from the password generator.

Everything happens on your device. Your aliases never leave this browser.