Email Aliases vs Plus Addressing: Which Protects You?

If you have compared email aliases vs plus addressing, you have met the two main techniques for giving each service its own address. Plus addressing (also called sub-addressing) is the trick built into Gmail, Outlook, Fastmail and most modern providers: anything you append after a plus sign is ignored for delivery, so jane+netflix@gmail.com still lands in jane@gmail.com. A true alias, by contrast, is a genuinely different address (often on a different domain) that forwards to your inbox.

Both give you a per-service label. Both help you spot who shared your address. But they are built on very different foundations, and the differences matter more than most comparisons admit.

Sub-addressing is standardised (the convention comes from the mail server world and is described in RFC 5233) and needs zero setup. You invent the tag at the moment you type it: jane+ebay@gmail.com, jane+gym@gmail.com. Your provider strips the tag on delivery and, in most clients, lets you filter on it.

It costs nothing and works today. For labelling (knowing which signup produced which mail), it is genuinely useful, and if you do nothing else, it is better than handing out a bare address.

A close cousin worth mentioning: Gmail also ignores dots in usernames, so ja.ne@gmail.com and jane@gmail.com are the same inbox. People sometimes use dot placement as another labelling trick, but it shares every weakness of the plus sign and is even easier for software to normalise away, so treat it as a curiosity, not a defence.

The fatal flaw is that your real address is sitting in plain sight. Anyone (human or script) who sees jane+netflix@gmail.com knows your real address is jane@gmail.com. Stripping everything between the plus and the at-sign is a one-line operation, and address-cleaning software used by marketers and data brokers does exactly that routinely.

That breaks the two security properties you actually wanted. You cannot revoke a plus address: spam sent to the bare address still arrives, so there is nothing to turn off. And you get no breach protection: a leaked plus address exposes your real login identifier anyway, so credential-stuffing attacks against your other accounts work just as well as if you had never bothered.

There are smaller annoyances too. A surprising number of web forms reject the plus character as 'invalid', and some deliberately strip the tag. And because the scheme is universally known, it signals exactly what you are doing to the party you are trying to track.

A real alias shares no visible connection with your inbox. shop@you.example reveals nothing about where it forwards. That single property changes everything downstream: the alias can be paused or deleted, at which point mail to it simply stops existing for you; and a breach that leaks the alias leaks nothing reusable against your other accounts.

Aliases on a personal subdomain also survive the form-validation problem: they look like perfectly ordinary addresses because they are ordinary addresses. The trade-off is that you need an alias service (a third party you must trust with mail in transit) and, for most polished options, a small subscription for unlimited use.

There is a quieter advantage too: an alias layer is an enforcement point. Because mail passes through the alias service before reaching you, filtering can happen upstream: a sender who turns noisy can be muted at the relay, so the mail never even lands in your inbox to be deleted. Plus addressing offers nothing equivalent; every message still arrives, and your filters merely file it.

Here is the honest scorecard:

Use plus addressing when the only thing you want is a label: sorting newsletters into folders, tracking which conference talk you signed up through, testing your own signup flow. It is the right tool for organisation.

Use true aliases when the goal is protection: anything you may want to revoke later, anything likely to end up in a marketing database, and any account whose compromise would hurt. Shopping sites, free trials, forums, apps you are merely evaluating: all alias territory. Your bank and your government logins deserve aliases too, precisely because those are the addresses you most want kept out of breach dumps.

The two techniques even combine: some people use plus tags on top of an alias for extra sorting. There is no rule against belt and braces.

If you decide aliases are worth it, look for three things in a service: instant catch-all creation (any address at your subdomain works without pre-registering it), per-alias controls (pause, delete, filter), and a clear data-retention policy. HideMy.world gives you exactly that (anything@you.hidemy.world just works, and each address carries its own rules), but the checklist applies whichever provider you choose.

The bottom line: plus addressing organises your mail; aliases protect it. Know which problem you are solving, and pick accordingly.