Another gated PDF wants my email address, and instead of typing my real one, I click a small icon in the corner of the form and let Proton Pass hand over something like sourdough-crate-19@proton.me instead. The form fills itself in, the download starts, and I never think about that address again unless it starts misbehaving. Four years into testing password managers on a dedicated laptop that exists for exactly this kind of thing, email aliases are the first feature from any vault app that changed my actual behavior in marketing ops, not just my risk tolerance. This is the part of Proton Pass that does more for phishing prevention and spam control than any password policy I've ever seen a SaaS company's IT team hand out.
That instinct exists because of a near-miss in 2022, when a support email from "HubSpot" looked right until you noticed the sender's domain was off by a single character. I've picked that particular flavor of phishing apart in more detail elsewhere: the short version is that a spoofed domain is built to survive a glance, not a read. What email aliasing does is remove the glance entirely. If a message shows up at an address I only ever gave to one vendor, I already know who leaked it, no matter how convincing the logo looks.
How Email Aliasing Actually Works Inside Proton Pass
The mechanism itself isn't complicated, which is probably why it took me years to bother with it. Proton Pass runs on SimpleLogin under the hood: every time a website or a marketing form asks for an email, the extension offers to generate a random one on the spot, something like bouncy-castle-42@proton.me, that forwards straight through to my real inbox. The vendor never sees my actual address at all, and I never see the difference on my end. The discipline is what makes it work: one alias per signup, never reusing a favorite across a dozen SaaS trials, because the whole value of the system depends on each address having exactly one place it could have come from. That's a different habit than leaning on whatever autofill your browser happens to offer, which hands over your real address every time and gives you nothing to trace once that address starts turning up in inboxes it has no business being in.
Underneath that, the vault data sits behind AES-256 encryption, which I've broken down in plain language elsewhere for anyone who wants the mechanics. For aliasing purposes, the detail that actually matters is zero-knowledge: Proton doesn't hold a readable copy of your master password anywhere, so a breach on their end doesn't hand your vault over along with it. The forwarded mail itself rides on PGP, which works less like a locked box and more like a wax seal. It doesn't just keep the message private, it proves nobody touched it in transit. None of that replaces a strong master password, which is its own topic I've covered in full elsewhere, but it's the layer underneath that makes the whole aliasing habit worth trusting.
When Is It Actually Worth Creating a New Alias?
My rule of thumb by now is almost mechanical: if a form is asking for an email in exchange for something I want exactly once, a whitepaper, a conference badge, a raffle entry, it gets an alias, no exceptions. I learned this the slow way standing in the checkout line at Central Market on North Lamar, tapping my real address into a tablet for a store loyalty program because it was faster than digging for my phone, and that inbox has been getting grocery promotions ever since. A friend of mine who sells sourdough most Saturdays at the HOPE Farmers Market asked recently whether she needed a separate alias for every co-op newsletter she signs up for as a vendor, and the honest answer was yes: anywhere you can't verify who's going to see that address six months from now, alias it.
The accounts that don't get an alias are the ones you'd need to recover by phone or in person: banking, insurance, anything where a support rep has to verify a real, callable identity. Everything else is fair game, though I wasn't always this disciplined about applying the rule. For a while after the LastPass breach disclosure came out in 2022, I stayed put, told myself it probably didn't touch my vault, and kept using the same account out of sheer inertia. That optimism aged badly, and eventually I moved everything over, alias habit included; somewhere in that process, the second phone I keep around for testing authenticator apps buzzed with a two-factor code, and for a second I couldn't tell which of a dozen apps on it I was even supposed to be checking. Whether a given tool will actually flag it when one of your addresses shows up in a breach dump is a separate question with its own answer, but aliasing at least limits how much damage one leaked address can do before you notice.
A Leaked Alias Always Points Back to the Leak
This is where the aliasing habit stops being tidy and starts being useful. A "special offer" landed not long ago from a CRM platform I hadn't touched in years, one that had supposedly folded. The pitch looked plausible enough, but it arrived at an alias I'd created solely for a demo signup on that exact platform, years earlier, nowhere else. There was no ambiguity about how the email found me: either the company sold its list on the way out the door, or someone scraped what was left of its database, and either way the alias told me everything instantly. Compare that to the same message landing in a real inbox, where you're stuck guessing which of forty-odd accounts is the source. It's the difference between a stranger calling your house and asking for you by name, versus asking for "whoever bought the blue couch," where you know immediately they got the number from the furniture store.
Killing that alias took one toggle, no different from a phone company shutting off a number a telemarketer won't stop dialing. I've written elsewhere about reducing my digital footprint after a near phishing marketing attack, and the alias-and-deactivate loop is the single most repeatable part of that project: a compromised address doesn't need a strongly worded email to the vendor, it just needs to stop existing. People still ask, reasonably, if Proton Pass is secure enough for my marketing operations vaults given how much rides on it, and the honest answer is that no tool is bulletproof. What it does give me is the ability to sever one leaked thread without touching the other forty-odd accounts, which is a meaningfully different security posture than a shared inbox ever offered.
The Single Point of Failure Nobody Mentions
Convenience and fragility turn out to be the same feature wearing different clothes, and that trade-off is worth stating plainly. If you use one real address everywhere and lose access to your password manager, recovery is annoying but survivable: you hit "forgot password" on every site and the reset links all land in the one inbox you still control. Spread across dozens of aliases instead, that same failure mode turns total. If the vault holding the alias list ever suffers a permanent sync failure or outright corruption, you don't just lose passwords, you lose the map of which address goes with which account; you won't know which alias touches your bank, your CRM, or a shared drive, because the entire point of the system was that nothing overlaps. I've explained AES 256 encryption for non-technical marketing managers before as a vault even the bank itself can't open, and that's exactly the problem here: it holds right up until the day you're the one standing outside without the combination.
Building a Recovery Plan Before You Need One
Fixing this part isn't complicated, just easy to postpone. A printed recovery key lives in a fireproof box now, filed alongside the handful of documents actually worth protecting from a house fire, and that's the only backup that matters if a master password ever gets forgotten or an account locks up. Setting up something more formal, a proper emergency kit someone else could use if I were ever unreachable, is a separate project with its own steps, but the printed key alone covers the everyday version of this risk. None of it needs to be expensive or elaborate: a sheet of paper in a safe place beats a clever system you'll forget how to use under stress.
That portability question isn't hypothetical, either. A loaner laptop at a Denver offsite once put the whole system to a real test: no time to hunt through browser bookmarks, just a fresh machine, one master password, and roughly 140 logins repopulating themselves in something like ninety seconds. That's the version of "it just works" that actually matters more than any feature list, and the deeper case for that kind of portability across devices is its own topic worth reading separately.
The Payoff: A Quiet Inbox With a Paper Trail
None of this fixes the underlying flood of marketing email that comes with running forty-plus SaaS subscriptions for a living, but it changes what that flood costs me. My primary inbox dropped from a few hundred daily messages to a manageable stream of things I actually asked for, because everything else routes to an address built for exactly one purpose and gets cut off the moment it stops earning its keep. Good login hygiene, it turns out, was never about the fanciest possible setup: it's about drawing a boundary an outsider can't see around, one disposable address at a time. If you manage even a fraction of the accounts I do, that boundary is worth building before the next spoofed domain lands in an inbox looking exactly right.