Why Your Real Inbox Shouldn’t Touch Random Signup Forms
Every account you create leaks your email address to a company you’ll probably never trust with anything else. That address then gets sold to data brokers, stuffed into breach dumps, and used to correlate your identity across sites you never linked yourself. Email aliasing services solve this by generating a unique, disposable address for every signup that forwards to your real inbox — so you can kill a leaked or spammy alias without touching your actual email. The two serious open-source options in this space are SimpleLogin and AnonAddy, which rebranded to addy.io in 2023. Both do the core job well; the differences show up in ownership, self-hosting, and how they handle replies.
SimpleLogin: The Proton-Owned Option
SimpleLogin was acquired by Proton (the ProtonMail/ProtonVPN company) in 2022 and now ships as a built-in feature of paid Proton Mail plans, alongside its standalone apps and browser extension. That acquisition cuts both ways. On the plus side, you get Proton’s infrastructure, a Swiss privacy jurisdiction, and tight integration if you’re already a Proton Mail user — aliases can be created and managed straight from the Proton Mail interface with zero extra setup. On the downside, you’re trusting a single company with both your real mailbox and your alias layer, which collapses the separation some privacy-focused users want between those two functions.
SimpleLogin’s free tier gives you 10 aliases on shared domains, unlimited replies/sends from those aliases, and one supported mailbox. The browser extension auto-fills a fresh alias on any signup form with one click, which in practice is the feature people use daily — it removes the friction that makes most people give up on aliasing within a week.
AnonAddy / addy.io: The Self-Hostable Option
addy.io (still commonly called AnonAddy from its earlier name) stayed independent and remains fully open-source under the AGPL, with an official hosted version and a self-hosted Docker deployment for anyone who wants to run the whole stack on their own VPS. The free hosted tier is more generous on shared-domain aliases than SimpleLogin’s default (it varies by promotion, but has historically sat higher), and it supports PGP encryption for forwarded mail out of the box — SimpleLogin supports PGP too, but addy.io’s implementation has been the more actively documented of the two for self-hosters.
The self-hosting path is the real differentiator. If you run your own addy.io instance, you own the alias database, the forwarding logs, and the domain entirely — no third party ever sees which alias maps to which real address, because that mapping never leaves your server. That’s a meaningfully stronger privacy posture than any hosted service, SimpleLogin included, but it comes with the usual self-hosting tax: you’re responsible for uptime, SMTP deliverability (getting your VPS’s IP off spam blocklists is its own project), TLS renewal, and security patching.
Head-to-Head Comparison
| Feature | SimpleLogin | AnonAddy / addy.io |
|---|---|---|
| Owner | Proton AG | Independent (addy.io team) |
| Self-hosting | Not officially supported | Yes, Docker-based, well documented |
| Free tier aliases | 10 (shared domains) | Higher, varies by promotion |
| PGP encryption | Supported | Supported, more self-host documentation |
| Browser extension | Yes, one-click fill | Yes, one-click fill |
| Custom domain support | Paid plans | Paid or self-hosted |
| Proton Mail integration | Native, built into the app | None |
Which One Actually Fits Your Threat Model
If you already pay for Proton Mail, use SimpleLogin — the integration removes an entire app from your workflow and there’s no real privacy cost since Proton already holds your mail. If you want your real email provider decoupled from your alias provider (a stronger setup if you’re worried about any single company being compromised or subpoenaed), pick addy.io’s hosted plan and pair it with a separate mail provider. If you’re technical and want the strongest guarantee — nobody but you ever sees the alias-to-real-email mapping — self-host addy.io on a small VPS (around $5-6/month covers it) and route mail through your own domain.
Setup Mistakes That Defeat the Whole Point
Aliasing only protects you if you use a fresh alias per site, not one alias for everything — a single reused alias just becomes your new trackable identifier. Also disable the "reply from alias" feature for accounts you don’t need to reply through, since some implementations expose your real address in mail headers when you reply, depending on client. Finally, don’t alias your primary bank or government accounts — those providers often reject forwarded/aliased addresses for account recovery, and you don’t want a lost-password flow blocked by your own privacy setup.
FAQ
Can a website tell I’m using an alias? No, an alias looks like any other email address to the receiving service. Only you and your aliasing provider know it forwards elsewhere.
What happens if my aliasing provider shuts down? Both are open-source; addy.io’s self-host option means you can migrate your own instance’s data. SimpleLogin’s data export exists but you’d need to manually update every account that uses a SimpleLogin alias if the hosted service ever disappeared.
Do I need a paid plan? Not for casual use — both free tiers cover the average person’s signup habits. Paid plans matter once you want unlimited mailboxes, custom domains, or higher alias counts.
Is self-hosting worth it for a non-technical user? No. If Docker, DNS records, and SMTP troubleshooting aren’t familiar territory, use the hosted tier of either service instead of fighting deliverability issues on your own server.
Verdict
Both services are legitimate, both are open-source, and either beats using your real address everywhere. SimpleLogin wins on convenience if you’re in the Proton ecosystem; addy.io wins on independence and self-hosting flexibility. For most readers who just want fewer breach-dump hits and easier spam cleanup, start with whichever service’s free tier you set up first — the habit of generating a fresh alias per signup matters more than which vendor issues it.
