Plus addressing is a filing trick dressed up as privacy advice. I run AliasFleet, an email-alias service: one forwarding address per site, so a leak names its source and one noisy sender dies alone. I still use plus tags to sort my own mail. But for signups the trick fails the privacy job: the tag strips off in one line of code, your real address sits inside every plus address, some forms reject the plus sign outright, and there is no off switch. A real alias per site fixes all four.
The trick, fairly stated
The mechanism is old and standardised. RFC 5233 defines subaddressing: the local part of an address splits into a user part and a detail part around a separator, usually the plus sign. Mail to you+shop@gmail.com reaches you@gmail.com, and the full tagged address stays in the To field. That is the whole trick. It costs nothing and needs no setup.
It genuinely wins two jobs. First, sorting. PCWorld recommends it for exactly this: set a filter for +shopping and every receipt and promo lands in one folder, out of the main inbox. Second, the tripwire. Hand a site you+chewy@gmail.com, and spam addressed to that tag names the leaker after the fact. Our leak-tracing guide uses plus tags this way, and states the limits up front. The OptMsg salting guide covers the same method independently and lands in the same place: salting is forensics, not a lock.
So the question is not whether the trick works. It is whether it does the privacy job people hire it for. Four rounds, scored one by one.
Round one: the signup form can refuse it
Fastmail says the quiet part in its own help docs: the main downside of plus addressing is that addresses with a + get incorrectly flagged as invalid, and some registration forms turn them away (source). PCWorld has the reader-side version: some signup forms reject the plus sign outright or throw an error. Nobody has measured how many forms do this. No study exists. But it happens often enough that the vendors warn you about it themselves.
Then Apple proved the point in August 2026. It planned to move Hide My Email addresses onto a new @private.icloud.com domain, and users pushed back: a clearly labelled alias domain would let websites spot and refuse the addresses at signup. Apple reversed course (TechCrunch); the addresses stay on @icloud.com, indistinguishable from ordinary iCloud mail. The market voted on this exact question. If an address looks like a trick, forms treat it like one.
A privacy tool that cannot get past the signup form is a tool you do not have when it matters. Round one to real aliases, which look like ordinary addresses.
Round two: the tag is a one-line delete
The fraud industry erases your tag as documented, routine procedure. MaxMind's minFraud normalisation docs describe step 14 of email preparation: for non-Yahoo domains, strip everything after and including the first + character before hashing. Your tag gets removed as a preprocessing step in a fraud-scoring pipeline. It is removed because it is noise for identity matching, and a tag that the legitimate industry deletes as standard is a tag nobody has to respect.
"deleting +chewy is one line of code, and anyone reselling addresses has every reason to run it." The OptMsg salting guide lands in the same place I do: salting is forensics, not a lock.
On the attacker side I will say exactly what I know and nothing more: I have no independent measurement of how many spammers run that line of code in the wild, so I will not invent a number. The motive is obvious and the technique is trivial, and the fraud industry's own docs show the practice is standard. A label that any recipient can delete is not protection. A Post-it note, not a lock.
Even the alias vendors agree here. SimpleLogin's published FAQ lists the + trick's failure independently: one line removes the plus part, and advertisers can link plus addresses together by stripping the tag. Round two to real aliases. There is no tag to strip, because the address is the address.
Round three: your real address is inside it
Every plus address contains your real address. That is structural, not a bug. Peel off the detail part and the local part underneath is the thing the tag was supposed to hide.
Proton's own docs say it outright. On its addresses and aliases page, Proton tells users to reach for plus aliases only when they want a quick way to organise a mailbox with filters, and warns that your real address is easy to guess from a plus address. For signups it points you at hide-my-email aliases instead, where the real address stays completely hidden. Microsoft's Exchange Online docs call plus addresses "extensions of their actual email address." The providers sell both products and tell you which one does the privacy job.
Hand a site you+bank@gmail.com and it holds, in effect, you@gmail.com. Recoverable by anyone with one line of string code. Round three to real aliases: the site gets an address that cannot be reduced to yours.
Round four: you cannot kill one tag alone
Gmail filters can label, archive or delete mail sent to you+noisy@gmail.com. What they cannot do is take the address away. It still exists, the site still holds it, and the mail still reaches your account before the filter touches it. There is no off switch for a tag. There is the filter, the delete key, and your time. Exchange Online makes the gap explicit: plus addresses are receive-only; they cannot send mail from plus addresses.
A real alias is a separate routing rule rather than a label on your inbox, so it carries its own switch:
| Plus tag | Real alias | |
|---|---|---|
| Your real address exposed to the site | Yes, inside the tag | No |
| Tag/address strippable by recipient | One line of code | Nothing to strip |
| Accepted on all signup forms | No, + rejected on some |
Yes, ordinary address |
| Off switch for one noisy sender | No, only filters | Yes, pause or delete |
| Sending from the address | Depends on provider, often needs setup | Supported with reply routing |
The products line up on this shape. Fastmail's Masked Email issues a unique address per login and lets you turn it off when spam starts. Firefox Relay hands out random masks, five free and unlimited on Premium, with per-mask blocking. DuckDuckGo Email Protection generates unlimited unique private addresses that forward while stripping trackers. Apple's Hide My Email generates a unique random address per site and lets you deactivate any of them. Outlook.com lets you add a real alias to your Microsoft account (source). Five vendors, one conclusion: the off switch is the feature.
Round four to real aliases. The fair section up top was the trick's one real win, so the scorecard reads 3-1. Plus tags still win the filing job; real aliases win everything else.
A +receipts tag with a Gmail filter that labels and archives order confirmations is a clean, free organiser. Our sibling piece on the plus trick's limits says the same. Filing and privacy are different jobs. Keep the tool that does each job.
The verdict: keep the trick, change the job
Nobody needs to delete their plus tags today. For sorting your own mail they are free, instant, and need no account, no app, no setup. The mistake is the second job people hire them for. A label on your real address protects it the way a name tag protects your house.
The upgrade keeps the good part and fixes the structural ones. Each site gets its own real address. The site never sees your real address at any point. Each address has its own off switch, so one noisy site dies alone. And when the site's database leaks, the address in the dump names the source without naming you. The mechanics are the ones what an email alias is walks through.
That is the shape AliasFleet is built around: one forwarding address per site, pauseable in one click, with two-way reply routing so replies go out from the alias and the site never learns the address underneath. The set-up guide takes about two minutes per method. The trade, stated plainly: the free tier covers 10 active aliases (pricing); past that there are paid plans, and you are trusting the provider's forwarding servers. If your address is already in a breach database, check Have I Been Pwned first, then rebuild forward with aliases instead of tags.
Use the plus sign for your filing cabinet. Use a real alias for your front door. The trick was never the enemy. Believing it was armour was.
Top comments (0)