Your email address is the most reliable tracking identifier you own, and you hand it out voluntarily several times a month.
Cookies expire. Device fingerprints drift. Ad identifiers can be reset. But the address you typed into a shoe retailer in 2019 and a newsletter in 2023 is the same string of characters, and any company holding both records can work out that those two customers are one person. That is the problem Brave is aiming at with the desktop release of version 1.94, which adds a feature called Email Aliases.
The short version
- What it does: generates a disposable email address that forwards to your real inbox, so a site never learns your actual address
- Where you use it: directly inside an email field on any site, without leaving the page
- The kill switch: if an alias starts attracting spam, you deactivate it and the mail stops. Your real address is never involved
- The price: five aliases free to start, with a paid Premium tier planned later
- What is missing: desktop only for now. Brave says mobile is coming
Why the address is the problem
Most privacy tooling in a browser fights a technical battle. Blocking third party cookies, randomizing canvas output, stripping tracking parameters out of links: all of that is the browser interfering with something a site is trying to do without asking.
An email address is different, because you gave it to them on purpose. There is nothing to block. The site asked, you agreed, and now a permanent, unique, human readable key to your identity sits in a database that will eventually be sold, merged, leaked, or all three.
Data brokers rely on this. Matching two customer lists on email address is trivial and extremely accurate, which is why “we do not sell personal data, only hashed identifiers” is such a hollow reassurance. A hashed email is still a stable join key. Hash the same address twice and you get the same result both times, which is the entire point.
How Brave’s version works in practice
The mechanic is deliberately boring, which is the correct design choice for something people need to do at speed.
You click into an email field on a signup form and generate an alias right there, without opening a settings panel or a separate app. Brave creates the address, the site receives it, and anything that site sends gets forwarded to the address attached to your Brave Account. Replies work. Password resets work. As far as the service is concerned, it has a normal customer.
The interesting half is what happens later. When an alias starts pulling in marketing you never asked for, or the company behind it gets breached and the address turns up in a credential dump, you switch that single alias off. The spam stops at the forwarder. You do not change your real address, you do not migrate anything, and every other account you own is untouched.
Brave says it stores both the primary address and the generated aliases in encrypted form, which matters because a forwarding service is by definition a company that knows every account you have ever created. The launch arrives alongside new Brave Accounts built so that passwords stay off Brave’s servers.
Five free is the number to pay attention to
This is where the feature meets its competition, and the competition is real.
| Service | Free tier | Best fit |
|---|---|---|
| Brave Email Aliases | Five aliases, Premium tier planned | People already using Brave who want generation inside the form field |
| DuckDuckGo Email Protection | Unlimited, free | Anyone who wants volume, plus tracker stripping inside forwarded mail |
| Firefox Relay | Five aliases | Firefox users who want the same trick in their own browser |
| Apple Hide My Email | Requires iCloud+, from $0.99 a month | People deep in the Apple ecosystem, where it is already wired into Sign in with Apple |
Five is a starter portion. If you use aliases the way they are meant to be used, one per service, you will burn through five inside a month of normal signups. DuckDuckGo giving away unlimited addresses for free is a genuinely awkward comparison, and it also strips tracking pixels out of mail before forwarding, which Brave has not matched.
Where Brave has the advantage is friction. Generating an address inside the field you are already typing in, in the browser you are already using, is meaningfully better than switching to an extension or a separate site. Privacy tools live or die on whether people can be bothered, and Brave has consistently understood that better than most. It is the same instinct behind the browser’s fingerprinting defenses, which is how Brave users ended up spotting AliExpress quietly playing silent audio to identify visitors before anyone else did.
What an alias does not fix
It is worth being clear about the boundaries, because “disposable email” gets oversold.
An alias protects the address, not the behavior. If you sign up with an alias and then log in from the same browser, on the same IP, with the same fingerprint, a determined tracker still has plenty to work with. It protects you against list merging and post breach spam, which are the two most common harms, and not against the full stack of tracking.
It also does nothing about data you have already given away. Every service that has your real address keeps it. Aliases are a forward looking measure, useful from the next signup onward, which is exactly the sort of caveat that gets buried when people are told to protect themselves after the fact. That same gap came up when women were told to delete their period tracking apps and deleting the app turned out to be the easy half.
And there is a practical failure mode: some sites reject addresses from domains they associate with disposable mail, and a few will lock an existing account if you change to one. Aliases work best on the long tail of retailers, newsletters and forums, which happens to be where most list selling occurs anyway.
Worth doing today
- Save your five for the right sites. Retailers, contests, one time downloads and anything asking for an address just to show you a PDF
- Keep your real address for accounts that matter. Banking, government, work, and anything where losing access would be genuinely painful
- Label them as you go. An alias you cannot connect to a site is an alias you will never dare switch off
The honest read
Email Aliases is not a new idea and Brave is not first. What it is, is the idea arriving in the place where it needs to be, which is inside the form field at the exact second you are deciding whether to hand over your address.
Five free is thin, and the Premium tier is clearly where this is heading. But the feature is free to try, it takes about ten seconds to understand, and it addresses something no cookie blocker can touch. If you already run Brave, there is no real argument against turning it on. If you do not, DuckDuckGo will give you the same protection in unlimited quantity, and the correct response to a privacy feature you like is to use whichever version of it you will actually keep using.
