Check where you use your address · No email needed

Where have you used your real email address?

To protect your real email, first check where you use it. Choose a use case to see whether you can change the address, what messages you still need to receive, and whether a dedicated alias makes sense.

Start checking Read about the limits first

Check one use at a time

Check first, then share your address

The same email address might appear in your bio and receive order notifications. Answer for one specific site or public page. When you’re done, reset the check to review another use.

This self-check requires JavaScript. You can still read the three types of recommendations and migration steps below, without submitting any personal information.

01 / Where does this address appear?

Choose the closest match. If more than one applies, start with the most directly exposed public use.

Publicly displayed People can see this address in your bio, forum signature, portfolio, or public document. Consider who can see it and whether you can edit the original page.

Provided during sign-up An online store, community, or app has your address for login, order emails, or notifications. Consider whether you still use it and can change the email on the account.

Recovery for important accounts Used only as a recovery or security contact for important accounts, such as your primary email, financial services, or work accounts. Consider whether you can keep accessing it and whether account recovery is reliable.

This tool can’t detect or verify whether your address has been exposed.

How to interpret your results

Not every use calls for the same kind of address

Aliases can separate routine sign-ups from your real email, but they can’t replace account security. Before changing an address, consider whether you could still recover the account if you lost access to it.

Can be moved

Move it to a dedicated alias

If you still need routine order emails or notifications and the service lets you change the email on your account, create a long-term forwarding alias just for that site.

Make sure the new address can receive email before changing your settings. Use one alias per site to help identify where future marketing messages came from.

Estimate how many aliases you need

Keep for the long term

Keep a long-term email address

Important account recovery depends on a long-term email address that you can access and manage independently. Don’t replace it with a temporary address that expires.

If the service doesn’t yet let you change the email on your account, keep access to the old address for now. Keeping it doesn’t mean you have to display it publicly or skip security checks.

Compare what each type of address is for

Security comes first

Secure your account first

If you find a login you didn’t make or changes to your password or recovery options, check your account through the official app or by entering the official website address yourself. Don’t click links in suspicious emails.

From a trusted device, change the password for the affected account. Change it anywhere else you’ve reused it, too.
Sign out of unfamiliar sessions. Review automatic forwarding, connected apps, and recovery email addresses, and remove anything you don’t recognize.
Turn on the multi-factor authentication offered by the service. If you can’t sign in, use its official recovery process.

Creating an alias won’t end an attacker’s existing sessions or undo changes to your recovery options.

Only migrate once it’s safe to do so

Set up the new address before changing the old one

Don’t disable your email only to find that the service needs you to confirm the change through your old address. Complete verification and recovery checks for one site before moving on to the next.

Sort incoming messages by alias

First, confirm the new address receives email

Create a forwarding alias for this site in your dashboard, send it a test email, and confirm it reaches your real inbox. Check your spam and archive folders. A successful test doesn’t guarantee every service will accept the address.
Then update your account details

Change the email in the service’s official settings, and complete any verification required for both the old and new addresses. Login, notification, and billing emails may be separate fields, so check each one.
Test notifications and account recovery

Trigger a test or verification email provided by the service and check where it arrives. Confirm that the recovery process uses your new email. Don’t sign out of your only active session just to test it.
Decide whether to remove the old address

Keep a record of which alias belongs to each site, and make sure orders, support issues, and subscriptions are taken care of. Remove only the old address for this site; don’t delete a real email that still helps you recover other accounts.

The limits of separating addresses

Changing where you use an address doesn’t erase the past

A dedicated alias can reduce how often you share your real email in the future, but it doesn’t make you anonymous or remove historical data.

You can’t take back an address that’s already public

Editing your bio or public page can stop the address from appearing there in the future. But screenshots, reposts, search caches, and copies saved by others won’t disappear just because you create an alias.

Remove the address from pages you can edit first, then deal with spam sent to the old address. If necessary, ask the site operator to remove it—but don’t assume a request means it’s been erased everywhere.

Sites may still be able to link activity to you

A site may still associate an account with you through your login status, phone number, payment details, device information, or other details you provide. Using different aliases doesn’t guarantee that your accounts can’t be linked.

If your public profile shows both an alias and your real identity, the alias won’t hide the connection. Share only the information needed for the task.

Disabling an alias only affects future messages to that alias

Disabling an alias won’t delete the email address a site has saved, cancel orders or subscriptions, or recall messages already forwarded to your real inbox.

Messages received through an alias are kept in the online archive for 30 days. Don’t treat it as permanent storage. Save important messages separately in your long-term inbox.

Don’t use a temporary address for long-term account recovery

Temporary addresses are valid for 3 hours by default. You can extend them before they expire, up to a maximum of 24 hours. They can receive messages but can’t send them. When an address expires, its messages are deleted, so don’t rely on it to recover an account later.

A forwarding alias may work for routine notifications from sites you use over time. For core account recovery, keep a stable long-term email address you control and maintain backup verification methods.

If you’re getting more marketing email but haven’t noticed other account issues, handle it as spam. Don’t assume a site has suffered a data breach based only on the volume of marketing messages.

Read the spam damage control guide

Share one fewer real email address next time you sign up

Start with one address you can change

Once you’ve confirmed the service lets you change your email, sign in without a password using your real email and create a dedicated forwarding alias. You can create up to 100 aliases per account. If you’re still dealing with spam sent to your old address, start with the damage control guide.

Return to this check and review another use

Where have you used your real email address?

Check first, then share your address

01 / Where does this address appear?

02 / Have you noticed any unusual account activity?

03 / Do you still need to receive email through this address?

04 / Does the service let you change your email address?

Why we recommend this