Ranked by how much difference each actually makes: stop giving the same address to every service; never publish it in plain text; use unique passwords so a leak stays a leak rather than becoming an account takeover; turn on WHOIS privacy if you own a domain; be sparing with what you attach to a signup; and keep your provider's spam filter on. Most of the advice below that line is worth doing. Two popular suggestions do nothing at all.
The things that make a real difference
1. A different address for each organisation
The highest-impact change by a distance, because it fixes the structural problem rather than its symptoms. One address per service means a breach exposes an address nobody else holds, spam identifies its own source, and you can revoke any single company's route to you.
Everything else on this list reduces the chance of exposure. This one reduces the consequences of exposure, which is more durable — because some exposure is inevitable. How to run it without creating a mess.
2. Never publish it in plain text
Anything readable on a public page gets harvested automatically. Check the places people forget: personal sites, forum profiles, public code repositories and commit history, CVs uploaded to job boards, conference attendee lists, PDFs, and community directories.
If you need a contact address publicly, publish an alias you're prepared to burn.
3. Unique passwords everywhere
Not strictly an email-privacy measure, but it's what decides whether a leak matters. A leaked address alone is a nuisance. A leaked address with a password you reused elsewhere is an account takeover. A password manager makes this a solved problem.
4. WHOIS privacy on any domain you own
Domain registration data has historically been public, and registrant records are a standard harvesting source. Most registrars offer privacy protection free or nearly so. If you're adopting a custom domain for aliases, turning this on is part of the setup, not an optional extra — otherwise you've traded an email exposure for a name-and-postal-address one.
5. Give less away at signup
Every field you complete is another attribute attached to your address in whatever database it lands in. Required fields are required. Optional ones — birthday, phone, postcode — are how a bare address becomes a profile worth reselling.
6. Keep the spam filter on
It won't reduce who holds your address, but it handles the volume. The FTC's advice is worth following: mark anything that slips through as spam, and check the junk folder occasionally for legitimate mail that shouldn't be there, since "filters aren't perfect." Source: FTC. Checked: 2026-08-19.
Worth doing, smaller effect
- Unsubscribe from senders you recognise. Legally backed and effective for legitimate companies — see does unsubscribing actually work.
- Block remote images by default, which stops most open-tracking pixels reporting back.
- Audit which accounts use your address and close the ones you've finished with.
- Use a separate address for anything public-facing — marketplace listings, domain contacts, job applications.
Two things that don't work
Obfuscating your address as "name [at] example [dot] com". This was mildly effective around 2005. Modern harvesters parse it trivially. All it reliably does is annoy the humans who want to contact you.
Using a VPN. A VPN protects your network traffic. Your email address travels inside the message, not the connection, and the recipient reads it either way. A VPN has no effect whatsoever on who holds your address or what they do with it. It's a good tool for a different job.
What about changing your address entirely?
Tempting when an address is unusable, and occasionally the right call — but it's a large migration and it fixes nothing structurally. A new address given to the same several hundred organisations ends up in the same state, just a few years later.
If you do start fresh, start fresh with per-service addresses, so the new one never gets handed out directly. That way the migration is a one-off rather than something you repeat every five years.
If your address is already out there
Assume it is — most are. That doesn't make any of this pointless; it changes what you're optimising for. You're no longer preventing the first leak, you're containing the next hundred and making them attributable.
Start by finding out where you stand: how to check if your email was in a data breach. Then the complete guide to email privacy for the full picture.