Gmail ignores everything between a + and the @, so you+shop@gmail.com delivers to you@gmail.com. It's free, instant, and genuinely useful for filtering your own mail and for spotting which company leaked your address. As a privacy measure it fails, because anyone — including any list broker — can recover your real address by deleting the tag. It hides nothing.
How it works
The feature is called subaddressing. Gmail, Outlook, Fastmail, Proton Mail and many others support it. The part after the + is passed through to your inbox but ignored for routing, so you can invent tags freely with nothing to configure.
Two things it does well:
- Filtering. Filter on the To: address and route
you+receipts@straight into a folder. This is what the feature was designed for and it works nicely. - Attribution. Use a different tag per company and spam at
you+hardware@gmail.comtells you the hardware shop's list got out. That part genuinely works.
Why it isn't privacy
Your real address is sitting in plain sight inside the alias. Recovering it requires deleting the characters between + and @ — an operation any competent list-cleaning script does automatically, and has for years, precisely because subaddressing is well known.
So the realistic outcome when a list containing you+shop@gmail.com is sold on is that the buyer stores you@gmail.com. You've kept the attribution signal and lost the protection.
This is the part that catches people. There's no way to disable a single plus-tag in Gmail — the tag isn't a real address with its own settings, it's a string Gmail ignores. You can build a filter that deletes mail to that tag, but the mail still reaches your mailbox and is still delivered to your account. The sender still has a working route.
With a real alias, disabling it stops delivery at the mail server. That's a different thing entirely — what actually happens when you disable an alias.
The third problem: sites reject it
A significant number of signup forms refuse addresses containing a +. Some validate email addresses badly; others block it deliberately to stop people creating multiple accounts. Either way you end up falling back to your real address at exactly the moment you were trying not to.
Plus-addressing compared with real aliases
| Plus-addressing | Real alias | |
|---|---|---|
| Cost and setup | Free, instant, nothing to configure | Free to a few dollars a year; some setup |
| Hides your real address | No — it's inside the alias | Yes |
| Survives list-cleaning | No — tags are stripped routinely | Yes |
| Can be switched off individually | No | Yes |
| Tells you who leaked you | Yes, until the tag is stripped | Yes |
| Accepted by signup forms | Often rejected | Usually accepted |
| Good for sorting your own mail | Yes — this is its real strength | Yes |
What it's genuinely good for
Don't dismiss it entirely — it has a real use. Plus-addressing is an excellent organisational tool. Tag your own mail so filters can sort it, tag things you sign up for so you know later where they came from, and use it as a zero-effort way to observe which companies share addresses.
Treat it as free instrumentation rather than protection. That's an honest framing, and on that basis it's worth using.
What to use instead for privacy
If you want the address to actually hide your inbox and to be revocable, you need a real alias — one where the address is distinct from your inbox rather than derived from it. Free options exist: DuckDuckGo Email Protection and Firefox Relay's free tier both cost nothing and both give you addresses that can be switched off.
If you want the addresses on a domain you own, that's the custom-domain route. All the options compared.
A reasonable middle position: keep using plus-addressing inside Gmail for sorting your own mail, and use real aliases for anything you hand to a company.
More: email aliases explained · how to get less spam in Gmail