After reading the recent social engineering of a user's twitter handle, I started thinking about ways to improve my own online security.

We can only do so much too protect ourselves because at the end of the day we have to trust the companies whose services we use to do their part in protecting us.

Nevertheless, I'm curious if using a unique email address for each online service adds a layer of security which increases the difficulty of social engineering attacks.

For instance, instead of using the same email address, e.g. [email protected] I would use something such as [email protected] or [email protected]. The _a4f3 part of the email address would be something random that has no specific meaning and makes it harder to guess than just using [email protected].

Alternatively, instead of some random string, using diceware to add a real word.

Is there any value in doing any of this?

  • 1
    Whenever I know my e-mail won't be used as my username, I use an address from www.10minutemail.com to sign up for sites. Just a tip.
    – KnightOfNi
    Feb 5, 2014 at 2:45

6 Answers 6


What you are thinking of should provide better security than using a single email address for everything. However, it is a major pain to manage. Major inconvenience is the worst enemy of good security because you will eventually break down and stop following your system.

What you should do is separate your identities. For example, there is no sense in using the same email address for both your Facebook or Twitter account and your bank account. Even worse, there is no sense is using the same email address for personal correspondence and business matters. For example, this guy was using the same email address for both his personal Amazon account and his startup's AWS account. It is generally a good idea to keep distinct identities for this purposes.

  • 1
    A technique that people sometimes use in order to have not too many (to remember/store) email addresses: use separate addresses for important logins, use one for the many other less important sites (forums, blogs...)
    – user13695
    Nov 27, 2014 at 7:43

Well sure, it would definitely provide another layer of security.

But realistically it's usually a pain to have a zillion different email addresses, one for each specific account. I prefer having 5-10 that I use for certain categories (e.g. personal, bills, etc.).

Here's a blog post that summarizes the idea quite nicely: https://securosis.com/blog/consumer-security-tip-use-multiple-email-accounts-to-reduce-fraud-and-spam

  • Do you use your own domain for all those addresses?
    – joshu
    Feb 5, 2014 at 14:13
  • Nope, just for my professional account - it's mostly Gmail for the rest. Addresses that aren't associated with your personal domain seem more "anonymous" to me, and Gmail has a pretty good spam filter. YMMV though if you're more concerned about privacy with the email provider itself.
    – Amy S
    Feb 5, 2014 at 23:03

With Gmail you can append anything after your email address as long as you add plus character before it. For example, [email protected] will always deliver emails to your real account [email protected]. However, you can still see from headers to which address the email was originally sent to. You can append the site name or just a random string to make it unique to site in question.

Actually, [email protected] is the same as [email protected] is the same as [email protected]. GMail will ignore dots and anything after + character. So there's no need to register any new addresses, you can use a single GMail address if you apply these rules.

  • 1
    This is called plus addressing and should work at any email provider, not just Gmail. Further, I believe gmail will also support a hyphen (-) for this purpose. Nov 27, 2014 at 8:39
  • 1
    This doesn't increase anonymity. Someone could easily figure out the main email address. This is useful for categorization only. Sep 5, 2018 at 21:34
  • 1
    Plus addressing is well known and spammers can trivially remove the added part and use the bare account name, whereas legitimate mailers who keep the address unchanged tend to provide honest sender information and a working unsubscribe mechanism. So plus addressing doesn't really provide much benefit unless you have a way of using a character other than plus for the separator. The same goes for the other trick of adding dots to Gmail addresses. Sep 30, 2018 at 22:55

I registered one domain name for this purpose, a domain name that has no meaning, not my name in it. I use a catchall for a subdomain. A catchall can be problematic with spam (as they can send it to any address in that domain once it's in their system), but up til now I don't get any. The main domain does not accept mail.

So take the domain xyzmail.info as example. I created MX records for qwe.xyzmail.info, set a catchall, and use that. Now I can use addresses like [email protected] and [email protected] etc. If [email protected] is hacked and my email address is stolen, I would expect spam coming in on this address at some point. Then I can redirect this alias to dev/null or set a rule to trash it. If the subdomain gets listed in spam listings, I could delete it and switch to another.

I could disable the catchall and create an alias for each new newsletter. That's not really usable, unless you can add a new alias with a (secure) one click action.

Do I use it and does it work? I've used this for maybe about 20 newsletters. I've used this once at a shop where they asked me for my address, and this caused a lot of confusion. I had to spell it out 10 times, and then explain why their name was in the address. So for those occasions I decided to use another address. To keep track of all logins I use Lastpass.

Looking back I don't see the point anymore and I guess I will switch back to an alias from my ISP sometime in the future. Gmail is an option. The + after the username in gmail may be a good alternative, but I guess spammers know this too, and may write a script to delete that automatically. Gmail antispam works good, so not a real issue.

I do separate my mail. Private and business is separate. Newsletters never to my private mail. Shopping with separate address. For Paypal, Apple, Amazon and some other really big names I use my private gmail.


This method is untested by me, but here's a suggestion: Try to keep the 'core' services like Google Apps and domain registrars on an alternate set of personal details. Maybe using a secondary home address, secondary phone number, etc. that never gets published on your social network and very few people know about. Of course don't store any credit card numbers on those services either, so an attacker would have to know your secondary details - which is much harder to get to.


There is a ton of value in doing this since an email address can be used as a key to unlock some doors. So, having separate emails for Web sites is like using separate keys for different doors.

If one key gets compromised, the other doors are still locked. So it reduces the blast radius of the security breach.

Besides plus addressing, some sites offer subdomain addressing, ie [email protected] which is helpful since some websites don't accept "+" addresses.

  • This just repeats other answers.
    – schroeder
    May 27, 2023 at 23:24
  • Show me the other answer that covered subdomain alias addresses. I'll wait.
    – majorgear
    May 29, 2023 at 20:37
  • So, all you wanted to add was an alternative to using a plus? That's not enough for a standalone answer. You could simply add this one small thing to the answer answers instead of posting a repetitive answer.
    – schroeder
    May 29, 2023 at 21:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .