How to Protect Your Email Privacy Online

Before adding new protections, understand how exposed you already are. Go to haveibeenpwned.com and enter your primary email address. This free service checks whether your email has appeared in known data breaches. Most people are surprised by the results — the average email address has been in 3-5 breaches.

Also search for your email address in a regular search engine. If it appears on public profiles, forum posts, or company directories, that is another avenue for spam and phishing. Knowing your starting point helps you prioritize which protections matter most.

Make a list of every service where you have used your primary email address. Most people underestimate this number by a factor of three or four. Browser-based password managers often have an audit feature that shows all saved logins, which gives you a clearer picture of your true exposure.

Stop using one email address for everything. Instead, create tiers. Tier 1: your real email, used only for banking, government, healthcare, and close personal contacts. Tier 2: a secondary email (free Gmail/Outlook) for services you use regularly but do not fully trust. Tier 3: temp email for one-time signups, downloads, and anything you will never need again.

This tiered approach means a breach at a shopping site (Tier 2) does not compromise your bank (Tier 1), and spam from a sketchy download (Tier 3) never reaches either real inbox.

The discipline is in correctly categorizing each new service before you sign up. It takes five seconds of thought: "Is this Tier 1, 2, or 3?" Most services fall clearly into one tier. When in doubt, use a lower tier — you can always upgrade an alias to your real email later, but you cannot take your real email back from a service that already has it.

Any time you encounter a signup form for something you will use once and forget about — free trials, gated content downloads, wifi login portals, contest entries, one-time tools — use a temp email. NukeMail gives you a private inbox for 24 hours with no signup required. Create an address, get what you need, and move on. The address ceases to exist on its own.

This is the single most effective step for stopping new spam. If your email address does not exist in a company's database, they cannot email you, sell your address, or lose it in a breach.

Think of temp email as the default for new signups, not the exception. Instead of asking "should I use temp email for this?" ask "is there a good reason I need to give my real email to this service?" Inverting the default makes privacy protection the path of least resistance rather than an extra step you have to remember.

For services you want to keep using but do not fully trust — online shopping, social media, newsletters you actually read — use an email alias service. SimpleLogin, AnonAddy, and Firefox Relay create unique forwarding addresses for each service. You can disable any alias instantly if it starts receiving spam, without affecting your other services or your real email.

Aliases give you permanent email access (unlike temp email) while hiding your real address (unlike plus addressing). They sit in the sweet spot between full privacy and full convenience.

Most alias services integrate with password managers and browser extensions, making it easy to generate a new alias at the point of signup. Firefox Relay is built directly into the Firefox browser, and SimpleLogin offers extensions for Chrome and Firefox. The setup takes a few minutes, and the habit becomes second nature within a week.

Gmail and Outlook are convenient but their business models involve analyzing your email for advertising and data purposes. Privacy-focused providers like ProtonMail, Tutanota, or Fastmail offer end-to-end encryption and stronger privacy policies. They cost a few dollars per month but remove the advertising company from your most private communications.

You do not need to switch entirely — using a privacy-focused provider for your Tier 1 (high-trust) email while keeping Gmail for Tier 2 is a practical compromise. ProtonMail and Tutanota both offer free tiers with enough storage for a Tier 1 email that receives limited traffic.

End-to-end encryption means the email provider itself cannot read your emails, even if compelled by a court order. This is a meaningful difference from Gmail, where Google holds the encryption keys and can access your data.

Go through your existing accounts and unsubscribe from marketing emails you do not want. Use the unsubscribe link in the email — this is more effective than marking as spam because it removes you from the list rather than just filtering. For accounts you no longer use, delete them entirely if the option exists.

Services like JustDeleteMe maintain a directory of direct links to delete your account on hundreds of popular services. Reducing the number of places that have your email reduces your breach exposure. Some services make deletion deliberately difficult, burying the option in nested settings menus. JustDeleteMe rates each service by difficulty, so you know what to expect.

For services that will not let you delete your account, change the email address on file to a temp email address before abandoning it. This does not remove your data from their servers, but it means future breaches of that service will not expose your current primary email address.

Sign up for breach notifications on haveibeenpwned.com so you are alerted when your email appears in a new breach. Firefox Monitor offers a similar service. When you get an alert, immediately change your password on the breached service and any other service where you used the same password.

If you use email aliases, you will know exactly which service was breached because each service has a unique alias. Disable the compromised alias and create a new one if you still want to use the service. This level of granularity is impossible with a single shared email address.

Set up monitoring for all email addresses in your tiered system — your Tier 1 and Tier 2 addresses at minimum. Breach alerts are most valuable when acted on quickly, so configure them to send notifications to your primary device.

A password manager (Bitwarden, 1Password, KeePass) is the complement to a multi-email strategy. It remembers which email address and password you used for each service, generates unique passwords, and alerts you to password reuse. Without a password manager, managing multiple email addresses and unique passwords for each service becomes impractical quickly.

Bitwarden offers a free tier that is genuinely usable. 1Password and Dashlane charge a few dollars per month but add features like breach monitoring, secure sharing, and travel mode. Any of them are vastly better than reusing passwords or trying to remember which email you used for each service.