Why You Should Use a Unique Email for Every Service

Using a unique email address for every service sounds like an eccentric habit until you count what your one shared address currently does. It is the username on your bank, your shopping accounts, your social media and your tax portal. It sits in the customer tables of every company you have ever bought from: companies whose security you cannot see and whose data-sharing agreements you will never read. One string of text, replicated across hundreds of databases, all pointing back at you.

Security practice long ago abandoned this pattern for passwords: nobody serious recommends one password everywhere. The same logic applies to the other half of your login, and in 2026 the tooling exists to apply it with almost no daily effort.

With a shared address, spam is anonymous. Something you signed up for years ago sold your details, and now you play whack-a-mole with filters against mail whose origin you can never establish.

With per-service addresses, every unwanted message carries its own confession: mail arriving at the address you gave one shop can only have originated with that shop. And the remedy is surgical: disable that one address and that entire stream ends permanently, with no unsubscribe forms and no signal to the sender that your mailbox is live. Your other addresses are untouched.

This changes your relationship with signups in a subtle way: consent becomes revocable. Today you hand over an address knowing you can never really take it back; with per-service addresses, every grant of access comes with a working off-switch, and companies only keep the privilege of reaching you for as long as they behave.

Data breaches hurt through two mechanisms, and unique addresses blunt both. Credential stuffing (replaying leaked email-and-password pairs against other websites) requires the same username to work across sites; when every account has a different address, the leaked pair opens nothing else. Profile-building by data brokers requires a common key to join databases on; when your address in one dataset appears in no other dataset, the join produces nothing.

You also gain a detection capability money can't otherwise buy: the moment strangers start mailing an address only one company ever knew, you have proof that company leaked, frequently before any public disclosure. Your inbox becomes its own breach monitor, with attribution built in.

AI-written phishing has become fluent and personalised, so 'does it read like a scam?' no longer works as a test. Per-service addresses give you a test that still works, because it checks routing rather than content: real mail from your bank arrives on the address you gave your bank. A message claiming to be your bank on any other address is counterfeit, no matter how perfect it looks.

This check requires no vigilance and no expertise: the address either matches or it does not. It is one of the few anti-phishing defences that got stronger, not weaker, as the fakes got better.

It even helps the other way round: when a genuine message arrives on the right alias, you can act on it with more confidence. Instead of second-guessing every 'confirm your account' email, you spend suspicion only where the routing already looks wrong.

The obvious worries, and why they mostly dissolve with modern tooling:

Nobody should migrate two hundred accounts in one sitting. The realistic plan has three phases. First, set up the machinery: an alias layer in front of your inbox and a password manager if you lack one. Second, migrate reactively: each time you log in somewhere over the coming weeks, spend thirty seconds updating the account's email to its own alias. Your most-used accounts migrate themselves in a month; the long tail can wait or die.

Third, change the default at the point of signup: new services simply never learn a shared address. With a catch-all subdomain there is nothing to set up in the moment. You type a fresh address straight into the form:

Follow this through and something quietly satisfying happens: your real email address stops appearing in databases altogether. It becomes what it should have been all along: a private channel for actual humans, while every company writes to an address you issued, can observe, and can revoke.

The daily experience barely changes: one inbox, autofilled logins, and each address carrying its own rules (pause this one, silence that one, delete the leaked one). That is the entire pitch of HideMy.world in one sentence, but the habit is bigger than any product: your address is a credential. Issue it like one.