Email Alias Planner & Leak Tracer

About the Email Alias Planner & Leak Tracer

Give each site its own address and you will know who leaked it. Many mailboxes take plus addresses: mail to you+anything@gmail.com reaches you@gmail.com. This planner makes one alias per site with a random tag that cannot be guessed (you+shop-k7q2m@gmail.com), keeps a ledger of which site got which alias, and shows which providers accept plus addresses, from their own help pages. With a domain of your own and a catch-all mailbox, the aliases can be whole addresses instead (shop-k7q2m@your-domain.com).

When spam arrives, paste the message’s headers or open the .eml: the leak tracer reads To, Delivered-To, X-Original-To and the Received lines and names the site that alias was given to — with links to ask that company what happened and to find where to report the sender. With a Pro pass you get the unlimited ledger, an encrypted copy of it, filter rules that file or delete mail sent to a leaked alias (Sieve, a Gmail filter file to import, and Outlook steps), and own-domain mode. Nothing is uploaded; the ledger stays on this device.

Common uses

• Finding out which shop, forum or app sold or lost your e-mail address.
• Filing newsletters and receipts by site automatically.
• Cutting off a leaked address without changing your real one.
• Keeping a record of which address you used where, for account recovery later.

Which providers take plus addresses

• Gmail: name+anything@gmail.com reaches name@gmail.com (Gmail Help); Google Workspace addresses work the same way (Google Workspace).
• Microsoft 365 work and school accounts (Exchange Online): plus addressing is on by default, but an administrator can turn it off, and you cannot send from a plus address (Microsoft Learn).
• Fastmail: plus addresses and subdomain addresses (tag@you.fastmail.com); a tag that matches a folder files the mail there (Fastmail Help).
• Proton Mail: plus aliases need no set-up (Proton Support).
• iCloud Mail: Apple’s help describes another kind of alias instead — up to nine separate @icloud.com addresses of 3 to 20 characters — and says nothing about plus addresses, so test one first (iCloud User Guide).
• Any other provider: send a test message to an alias before you give it out.

What plus addresses cannot do

Fastmail notes that addresses with a + “are incorrectly considered invalid by some websites”, and Proton that “your real address is easy to guess from a plus address” — anyone who removes the tag reaches your inbox. Aliases on a domain of your own (a catch-all mailbox) have neither problem: the alias is a whole address and says nothing about your main one. Check that the domain receives mail with the MX Lookup, and that its SPF and DMARC records are in order before you rely on it.

Filter rules

• Sieve (RFC 5228) is the filter language of many mail servers and of providers such as Proton Mail (Proton’s Sieve guide). The rules here match the alias in the envelope and in the To and Cc fields, then move the mail to a folder you name (Spam, Junk …) or delete it. A shorter form matches only the tag with the RFC 5233 “subaddress” extension, for servers that support it — Proton’s list of Sieve extensions has envelope and fileinto but not subaddress, so use the whole-alias form there.
• Gmail: download the Gmail filter file and import it under Settings → See all settings → Filters and Blocked Addresses → Import filters → choose the file → Open file → Create filters. It is the same kind of .xml file Gmail writes when it exports filters; mail that the rules move to a folder gets that label and skips the inbox. By hand: in the search box choose Show search options, type the alias under To, then Create filter (Gmail Help).
• Outlook and Microsoft 365: an inbox rule with the condition Recipient address includes and the alias, as Microsoft suggests for plus addresses.

Limitations

• Tracing needs a header that still shows the alias. Some messages hide recipients (Bcc, “undisclosed recipients”); then Delivered-To, X-Original-To or the Received lines usually still show it.
• A leak only shows which address was used, not how it got out: the site may have been breached, may have shared the list, or someone may have typed your alias in.
• The ledger lives in this browser. Clearing the site’s data deletes it, so keep an exported copy.
• The free preview keeps aliases for up to 3 sites and shows one leak trace per visit.

Privacy

On this device: nothing is sent

Aliases, the ledger and the messages you trace stay on this device. The ledger is kept in this browser only while “Keep the ledger on this device” is ticked; messages are read in the page and never stored or sent.