Gmail has three aliasing mechanisms and none of them hide your address. Plus-addressing (you+shop@gmail.com), dot-insertion (y.o.u@gmail.com) and Workspace aliases all resolve visibly to your real mailbox, so anyone can strip the tag and recover it. If you want tagging, they're fine. If you want an address you can switch off without losing your inbox, you need a forwarding alias service instead.
The three things people mean by "Gmail alias"
| Mechanism | What it looks like | Hides your address? | Can you switch one off? |
|---|---|---|---|
| Plus-addressing (subaddressing) | you+netflix@gmail.com |
✗ — delete the tag | ✗ — only filter it |
| Dot insertion | y.ou@gmail.com |
✗ — dots are ignored | ✗ |
| Workspace alias (paid) | shop@yourdomain.com |
✓ from the sender's view | ✓ but admin work each time |
| Forwarding alias service | netflix@yourdomain.com |
✓ | ✓ one click |
Why the two free ones don't work for privacy
Plus-addressing and dots share one defect: the transformation is public and reversible. Everyone knows Gmail ignores dots and strips + tags, so recovering you@gmail.com from you+netflix@gmail.com is a one-line operation any list broker performs by default before selling a file. The tag survives exactly as long as nobody has a reason to remove it, which is not a security property.
They also can't be revoked. There is no such thing as switching off you+netflix@ — Gmail has no concept of it as a separate address. You can filter it into the bin, but the mail still arrives, still counts, and still tells the sender the address is live. The full explanation of where plus-addressing does and doesn't help goes into this in more detail; it's genuinely good at filtering and genuinely bad at privacy.
And a practical annoyance before either of those matters: a meaningful number of signup forms reject + outright as an invalid character, so the technique fails at the moment you need it.
Google Workspace aliases: closer, but the wrong shape
If you pay for Workspace on your own domain, you can add alias addresses to a user and even route a catch-all. This does hide your real mailbox, and it puts the addresses on a domain you own — the two things the free tricks can't do.
The problem is operational. Each alias is an admin-console action, which means you won't create one at the moment you actually need it — standing at a checkout form. A per-service address scheme only works if making an address costs nothing at the point of signup, and Workspace aliases cost a detour into an admin panel. Google's catch-all routing solves that, but it's a domain-wide setting rather than per-address, so you lose the ability to switch off one leaked address without touching the rest.
Workspace is also $7+ per user per month, which is a mail-hosting bill you'd only pay if you wanted Workspace anyway.
What actually replaces it
If you want to keep Gmail as your inbox
You don't have to leave. Every alias service on this list forwards into whatever mailbox you already use, Gmail included — you keep the client, the filters and the search, and only the addresses you hand out change.
- DuckDuckGo Email Protection — free, unlimited, replies work, strips trackers. The direct free replacement for plus-addressing, and the one to try first.
- Firefox Relay — 50 free masks, browser extension that fills them into signup forms.
- SimpleLogin — 10 free, unlimited on a domain you own at $36/yr, open source, and it supports replying.
If you want the addresses to be yours
Aliases on a domain you registered survive you changing provider — including changing away from whoever you pick now. Forward Email does this free if you already have a domain. So do we: unlimited addresses on your domain, each one starting to work the first time mail arrives, with no creation step and no admin console. We don't support replying, which for some people rules it out.
Either way the domain is the real cost — roughly $10–15 a year — and it's what buys the portability. The trade-off in full.
What you gain over plus-addressing
Two things, and they're the same two things every time.
Revocation. When an address starts receiving mail from someone you never gave it to, you switch that address off and the problem ends. Nothing else in your inbox changes. With a + tag your only option is a filter, which hides the symptom while the sender keeps a live address.
Attribution that survives. Plus-addressing does tell you who leaked you — right up until the broker strips the tag, at which point the trail vanishes and the spam arrives at your bare address with no label on it. A real alias can't be stripped back to anything, so the attribution holds however many hands the address passes through.
More: plus-addressing explained · reducing spam in Gmail · the free alias tiers compared