Every shop, cafe wifi page and newsletter box wants your email address and your mobile number. Hand them over and you cannot take them back: they get copied, passed on, bundled up and sold, and the only thing you can do afterwards is chase them. An alias stops that at the point it starts, and it takes about ten seconds.
There is a trap in this, though, and the lists going round social media never mention it. Some things must have your real number and an inbox you own. Get that wrong and you will not be more private, you will be locked out of your own account. That part is at the bottom, and it is the bit worth reading twice.
Why fewer copies is the whole point
You are not trying to hide. You are trying to keep the number of companies holding your details down, because every one of them is a place it can leak from. The NCSC puts it plainly: “The most common way that passwords are stolen is when an organisation holding your details suffers a data breach”. Your address is the username in most of those breaches.
It also decides how much junk you get for the next decade. Once an address is on a marketing list it gets traded, which is the same problem we cover in our guide to getting off data broker lists. Aliases are the cheaper half of that job: stop the leak now rather than chase the copies later.
Email aliases: the four decent options
An alias is a made-up address that forwards to your real inbox. The shop sees the alias, you get the email in the normal place, and if it starts spamming you, you switch that one address off and everything else carries on.
Apple Hide My Email
If you have an iPhone, this is the least effort. Apple describes it as generating “unique, random email addresses that forward to your personal email inbox automatically”, and you can reply from them without showing your real address.
The catch: using it through Sign in with Apple is free, but Hide My Email as a general tool, for typing into any form you like, is part of iCloud+, which is the paid tier. We earn nothing from Apple either way.
DuckDuckGo Email Protection
Free, and it does something the others mostly do not: it strips tracking out of the message on the way through. DuckDuckGo calls it “a free email forwarding service that removes multiple types of hidden email trackers and lets you create unlimited unique private email addresses on the fly”, and it forwards into the inbox you already use, whether that is Gmail, Outlook, Apple Mail or Proton. We earn nothing from them, which is part of why we are happy to put it first for most people.
Firefox Relay
Mozilla's version. Everyone gets 5 email masks free, and the paid tier lifts the limit. Their FAQ lists the United Kingdom among the countries where the premium tier is sold, which is worth checking because not every service on these lists is actually available here. We earn nothing from Mozilla.
Proton Pass aliases
If you want aliases living inside your password manager, Proton Pass describes an alias as “a randomly-generated email address that forwards emails to your main inbox”. The free plan includes 10 hide-my-email aliases, and the paid plan makes that unlimited. The same technology is sold on its own as SimpleLogin, which is open source and now part of Proton. If you decide to take it up, our Proton Pass link is the one that pays us.
Be clear about our interest here: we earn a commission if you sign up to Proton through our link, and we earn nothing from Apple, DuckDuckGo or Mozilla above. All four work. We have marked which is which so you can weigh what we say accordingly, the same as on our tools page.
Public throwaway inboxes, and what they are actually for
These are the sites that give you an address instantly with no sign-up. They have one honest use: something wants an address before it will hand over a file you need, and you are never going back.
Understand what you are using, though. Mailinator says it itself: it offers a “100% free, public temporary or disposable email address”, and you “can use any address @mailinator.com and check those public inboxes”. Public means public. Anyone who guesses the address reads the mail, including anything that arrives later.
So: fine for a one-off download. Never for anything with a password attached, a receipt, an order, a code, or your name in it.
Throwaway phone numbers
The free “burner number” sites work the same way as the public inboxes: the numbers are shared, and the messages sent to them sit on a web page for anyone to read. For a form that insists on a mobile before it will show you something, that is harmless.
For anything else it is a bad idea, and here is the mechanism rather than a scare story. The NCSC explains that with 2-step verification “you'll be sent a PIN or code, often by SMS or email”, and the whole thing rests on the assumption that “it's presumed only you” can get at that phone or inbox. A shared public number breaks that assumption on day one, because the code lands somewhere strangers can read it.
The slower version of the same problem is a number you stop paying for. Once it is not yours, it is no longer something only you can reach, which is exactly the assumption your accounts are relying on. If an account can be reset with a code sent by text, then control of that number is control of the account, so a number you have given up is a loose end worth tidying before you let it go. Our rule:
- Shared public number: only for a form that gives you nothing in return.
- A second real SIM: fine, as long as you keep paying for it and treat it as yours.
- Anything with a code or a password: your real number, every time.
The sensible middle: a second real mailbox
Aliases are not the only answer, and for a lot of people they are more fiddling than they want. The low-tech version works nearly as well: one free mailbox used only for shops, loyalty cards and newsletters, kept separate from the address you use for your bank, your work and your family. Junk goes in one place and the important post stays readable in the other.
If you want that second mailbox to be a private one, Proton Mail is the one we use, and again, we earn a commission if you sign up through that link. A free Gmail or Outlook account does the separation job perfectly well and costs nothing, so pick on whether you want the privacy or just the tidiness.
There is also Sign in with Apple or Sign in with Google, which hides your address from the site you are joining. It genuinely reduces how many companies hold your email. The trade is that the account now depends on that company: lose access to your Apple or Google account and you lose the sign-in with it. Apple says Sign in with Apple “won’t track or profile you as you use your favourite apps and websites”, and that it keeps only what it needs to let you sign in. Google makes no equivalent promise that we can point you to. Reasonable for a shop, less so for anything you would hate to lose.
When a site demands your mobile number
Most of the time, a phone field exists so they can market to you, and UK law is on your side about that. The ICO's guide to PECR says the rules “restrict unsolicited marketing by phone, fax, email, text, or other electronic message”, and that a company “will often need specific consent to send unsolicited direct marketing”, normally by getting you to tick an opt-in box. So leaving that box unticked is the point of it, not an act of rebellion.
The useful distinction is what the number is for. The ICO is clear that “routine customer service messages do not count as direct marketing”, and gives delivery arrangements as an example. A courier texting you a delivery slot needs your real number. A clothes shop wanting it at the till does not.
If the texts have already started, you can stop them: see our guides on registering with the TPS and blocking numbers, and forward scam texts to 7726 free of charge, which we cover in how to report a scam.
Which should I use for what
| The situation | What to give | Why |
|---|---|---|
| A shop at the till, or a wifi login in a cafe | An alias, or nothing at all | They want it for marketing, not for the sale. |
| Newsletters, competitions, free downloads | An alias | If it turns into spam you switch the alias off, not your inbox. |
| A one-off file you need and will never go back for | A public throwaway inbox | Nothing private is going through it. |
| A delivery that needs texting to you | Your real number | Delivery updates are not marketing, and a courier cannot reach a shared number. |
| Banking, HMRC, the NHS, your council | Your real number and an address you control | You will need to prove it is you, possibly years from now. |
| Anything with a password or a 2-step code | Your real number and an address you control | Lose the number or the inbox and you can lose the account. |
The honest summary
- Pick one alias service and use it for shops, newsletters and wifi logins. DuckDuckGo if you want free, Apple if you are on an iPhone and already pay for iCloud+.
- Public throwaway inboxes and shared numbers are for things you will never need again, because strangers can read both.
- Banking, government, and anything protected by a password or a code gets your real number and an inbox you own. No exceptions, however good the privacy tip sounded.
- None of this hides you from your mobile network, and none of it deletes what companies already hold. That is a different job, and it starts with the brokers.