addy.io (AnonAddy) & SimpleLogin: Alias Setup and Review

addy.io, formerly AnonAddy and sometimes searched as Addy Mail, is the best-value email alias service for most people: open source, unlimited standard aliases free, a custom domain for $1 a month billed yearly, and PGP-encrypted forwarding. Its catches are a 10 MB monthly bandwidth cap and no replies on the free plan; SimpleLogin free allows replies.

Email aliases give every signup its own throwaway address that forwards to your real inbox. If one alias starts getting spam or shows up in a breach, you disable that single address and your real inbox is untouched.

The earlier comparison of alias services covers which to pick. This is the step-by-step “now set it up and use it” guide.

addy.io vs SimpleLogin: Which One to Set Up

The deciding question is whether you mostly receive through aliases or also need to write back. From addy.io’s pricing and FAQ, and SimpleLogin’s pricing and homepage, checked September 2026:

For receive-mostly use (signups, receipts, newsletters) addy.io’s free plan goes further, because the alias count never runs out. To write back through aliases without paying, SimpleLogin free is the only option of the two, though ten aliases fill fast. Premium bundles Proton Pass premium; if that appeals, weigh how private Proton really is before concentrating more accounts with one company.

Step 1: Pick a Service and Create an Account

Both free tiers are usable; the table above shows where each one runs out.

Create an account and set your real inbox as the forwarding destination. This is the address every alias will quietly deliver to — your encrypted mailbox, ideally. Verify it.

Step 2: Create Your First Alias

In the dashboard, create a new alias. SimpleLogin’s alias docs describe two buttons: Random Alias, which generates random words or a UUID, and New Custom Alias, where you choose the prefix and can add a note. On addy.io you get either a generated shared-domain address (random characters in front of @anonaddy.me) or any address you make up in front of @yourname.addy.io, your own subdomain. Those two addy.io forms behave differently, as the section on its two alias types explains.

A useful habit: name the alias after where you’re using it. An alias that starts with netflix or chase-bank tells you at a glance which service it belongs to, which is invaluable later when an alias starts getting spam and you want to know who leaked it.

Use that alias as your email when signing up for the service. Mail sent to it forwards to your real inbox automatically. The sender never sees your real address.

Step 3: Install the Browser Extension

Both services offer browser extensions, and this is what turns aliasing from a chore into a reflex. When a signup form asks for your email, the extension offers to generate a fresh alias right there in the field — one click, named after the current site, no dashboard visit.

This is the difference between “I’ll use aliases for important stuff” and “every signup gets its own alias automatically.” Install the extension and the friction effectively disappears.

Step 4: Learn to Reply Through the Alias

The feature people miss: you can reply so the recipient sees the alias, not your real address. SimpleLogin includes this free; addy.io’s FAQ says a reply sent from a Free account will not be delivered.

It works through a reverse alias. When a forwarded message lands in your inbox, replying to it routes back through the service, which rewrites the sender so the recipient sees the original alias (SimpleLogin’s explanation). To them, the conversation is entirely with your netflix alias; your real address never appears in either direction.

Without this, aliases only protect incoming mail; the moment you reply, your real address leaks. So set this up and use it for any alias you expect to correspond through.

Step 5 (Optional but Recommended): Add a Custom Domain

Provider-branded aliases (@simplelogin.io, @anonaddy.me) work fine, but a custom domain is more portable and less obviously a “throwaway.” With a custom domain you create aliases on demand in front of @yourname.com.

This requires a paid tier (SimpleLogin Premium, or addy.io’s $1/month Lite) and a few DNS records — MX pointing to the service, plus SPF and DKIM for deliverability — added at your registrar following the service’s exact values. Once verified, you can invent unlimited new aliases on your own domain without even visiting the dashboard, because the service catches anything sent to the domain.

One trap before you touch DNS: incoming mail follows a domain’s MX records and a domain publishes one set of them, so pointing a domain at an alias service replaces whatever was delivering your mailbox at Proton Mail or anywhere else. Use a subdomain (alias.yourdomain.com) and the parent domain keeps working with your existing provider.

The portability payoff is the same as with custom-domain mail generally: if you switch alias services later, you re-point the domain and every alias keeps working.

Step 6: Turn On PGP Encryption (If You Want It)

A subtle leak: an alias service sees your forwarded mail in plaintext as it relays it, unless you encrypt the hop. Both services support PGP encryption of forwarded mail — you upload your public key, and the service encrypts each message before delivering it to your inbox.

If your threat model includes not trusting the relay itself, enable this. For most users protecting against spam and breach correlation, it’s a nice-to-have rather than essential.

The Per-Signup Workflow

Here’s the routine that makes aliasing pay off:

1. Every new account gets its own alias, generated via the extension and named after the site.
2. When an alias starts getting spam, you know exactly who leaked it or sold it to a broker list. Disable that alias; your inbox goes quiet again and nothing else is affected.
3. When a service appears in a breach, that alias is the only address exposed. Burn it, create a new one for that account, done.
4. You keep one or two stable aliases for high-value accounts (bank, primary identity) that you never burn, and treat everything else as disposable.

The result is a clean separation: a leak or breach is contained to a single address instead of poisoning your real inbox forever.

What Aliases Don’t Do

Set expectations. Aliases hide your real address from the recipient, but the relay service still knows the alias-to-inbox mapping (what each alias service logs and can be compelled to hand over), which is why the service’s own privacy posture matters; both of these are reputable. And aliases protect the address, not the content — that’s what end-to-end encryption is for. Used together, they’re a strong combination.

addy.io and AnonAddy: One Service, Several Names

If you pick addy.io, the first thing to clear up is the name. The service launched as AnonAddy and rebranded to addy.io, and both names still surface in the product: the source code lives under the anonaddy organisation on GitHub, the shared alias domains include anonaddy.com and anonaddy.me alongside addy.io, forwarded mail carries an X-AnonAddy-Authentication-Results header, and a personal subdomain is offered as username.addy.io while the legacy username.anonaddy.com form still works. So “AnonAddy”, “anon addy”, “addy mail” and “addy.io” all mean the same open-source relay. The rename was announced on 9 August 2023, when the web app moved to app.addy.io; existing alias domains were kept, so old AnonAddy aliases still deliver. Per the FAQ, a UK developer, Will Browning, runs it, with the primary mail server in Amsterdam and a backup in Warsaw: an EU-hosted relay with a UK operator, a jurisdiction split worth noting if that matters to your threat model.

addy.io Review: Is AnonAddy Worth Using?

Yes, if you want lots of aliases for little or no money. addy.io is open source under AGPL-3.0, still actively developed (server release v1.7.2 landed on 2 September 2026), and gives unlimited standard aliases on its free plan where SimpleLogin stops at ten. It is the wrong pick if you need free replies or forward heavy newsletters without paying.

Strengths: a custom domain for $12 a year on Lite; per-recipient PGP forwarding, which the FAQ does not list among its paid-only features; and public source code for the server and both mobile apps, with a server you can self-host.

Weaknesses: a free plan capped by bandwidth (about 140 average emails a month) rather than by aliases, and a small operation: the FAQ names one developer and says someone is in place to keep the service running if the developer cannot.

Verdict: start on Free to learn the workflow, and move to Lite once you want replies, a custom domain or more than about 140 forwards a month. Pro ($36 a year) pays off only for unlimited bandwidth, several custom domains or the sender blocklist.

How to Use addy.io, Step by Step

1. Register at app.addy.io and pick the username with care. Every standard alias shows it to every site you sign up to, so avoid anything tied to your name.
2. Verify your recipient, the real inbox aliases forward to (one on Free, five on Lite).
3. Install the browser extension or the iOS or Android app, which are free for all users.
4. Create aliases on the fly. Type a fresh address on your subdomain into any signup form and catch-all creates it on the first message; use a shared-domain alias when the subdomain should stay hidden.
5. Add a PGP key. Under Recipients, click Add PGP key, paste your ASCII-armoured public key, and switch on Hide Email Subject. Leave inline PGP off: the encryption help page warns it forwards only plain text, dropping attachments and HTML.

addy.io’s Two Alias Types

This one distinction decides whether addy.io suits you.

Standard aliases live on a subdomain that is yours: any address in front of @yourname.addy.io. You pick the username once, and after that every address on that subdomain works as a catch-all — invent an address at a checkout page and addy.io adds it when the first message arrives. These are unlimited on every plan, free included. The catch: every site sees the same yourname.addy.io subdomain, so two services comparing notes can tell one account sits behind both aliases (they still never see your real address).

Shared-domain aliases use addy.io’s own domains in generated forms, such as a random string in front of @anonaddy.me. They carry no shared fingerprint, which is exactly why they are the metered resource — capped by plan. Two ways to soften the standard-alias trade-off: additional usernames split aliases into separate subdomains (personal, work, hobbies), and a custom domain removes the tell entirely. If linkability is a new idea, what email metadata leaks is the fuller version of why a shared identifier across accounts matters even when the content is private.

addy.io Plans and the Limits That Actually Bind

From addy.io’s published pricing, rechecked September 2026:

Duo ($4.50/mo yearly or $6 monthly, two members) and Family ($7.50/mo yearly or $10 monthly, five members) give every member full Pro under one subscription; for two people Duo beats two separate Pro seats. The one genuinely Pro-only feature is the sender blocklist — Lite already includes failed-delivery replay, the priority queue and regex auto-creation.

Bandwidth, Not Alias Count, Is addy.io’s Free-Tier Ceiling

Alias count gets the marketing; bandwidth is what stops people. Every forwarded message and reply increments a byte counter that resets monthly. addy.io’s FAQ puts the average email at roughly 75 KB, which makes the free plan’s 10 MB about 140 forwarded emails per month and Lite’s 100 MB roughly 1,400. Attachments count, and image-heavy newsletters burn the allowance far faster than that figure suggests — so if newsletters are where your aliases land, budget for Lite from the start. Deactivating a spam-hit alias stops the drain immediately, because discarded mail is not counted. Alias creation is separately rate-limited (10 per hour on Free), which only bites during a bulk migration.

Replying From an addy.io Alias, and the Two Ways It Fails

Sending out through an alias is what makes aliases usable for real correspondence. You reply from a verified recipient address on your account, addy.io rewrites the sender, and the other party only ever sees the alias; the forwarding banner and any attached PGP key are stripped automatically. Anonymous reply and send is a paid feature (50/day on Lite, 200 on Pro), and there is no SMTP option. Two failures look like a broken service but are not:

• The reply comes back to you instead of going out. You sent from an address that is not a verified recipient, so addy.io treats you as an outside sender. Check the “from” address in your sent items.
• The send is rejected (“Attempted reply/send from alias has failed”). Sending from an alias triggers anti-spoofing checks, and your verified recipient’s domain has to pass DMARC. Gmail, Outlook, Proton Mail and Tuta already publish it; the problem only hits a recipient address on a personal domain with no DMARC record. The fix is a _dmarc TXT record on top of working SPF and DKIM — setting up a custom domain with an encrypted provider covers those three records. If a red spoofing banner shows up on a forwarded message, how to read email headers explains the X-AnonAddy-Authentication-Results header that says why.

addy.io’s Per-Recipient PGP, Custom Domains and API

By default any alias service can read the mail it relays. addy.io lets you close that gap by adding an OpenPGP public key per recipient, so forwarded mail is encrypted to your key before delivery, attachments included, with optional subject-line replacement. You only need the public half of a key pair; how to set up PGP email encryption covers generating one. For a custom domain, catch-all is on by default (which is what makes invent-on-the-spot addresses work), so unfamiliar aliases appearing in your dashboard when spammers guess addresses is normal, not a compromise. And because the whole application is open source and self-hostable with a developer API, the relay you trust with your mail can be one you run.

---

Related: which service fits your needs — see the alias services compared. For why a separate address per context matters at all, what email metadata leaks. And if your real inbox is still Gmail, aliases buy compartmentalisation but not confidentiality — how to encrypt email in Gmail explains what Google can still read. To have a provider and an alias strategy chosen together, the find-your-setup wizard does both at once.

FAQ

Is addy.io safe to use?

For most threat models, yes. The code is open source, the FAQ states there are no adverts, analytics or trackers beyond server access logs, and mail is stored only after a failed delivery if you opt in. The relay can still read forwarded mail in transit unless you add a PGP key to your recipient.

Does addy.io have a mobile app?

Yes. addy.io publishes free official apps for iOS and iPadOS on the App Store and for Android on Google Play and F-Droid, with source code on GitHub. The F-Droid build reached v6.5.0 on 5 September 2026 and needs Android 6.0 or newer. It manages aliases, recipients and more from a phone, tablet or wearable.

How many aliases can you make with SimpleLogin for free?

Ten. SimpleLogin’s free plan gives 10 aliases with unlimited bandwidth, one mailbox, replies from aliases, browser extensions and mobile apps. Premium, at $36 a year or $4 billed monthly as of September 2026, removes the cap and adds unlimited custom domains, catch-all, five subdomains, 50 directories and PGP-encrypted forwarding.

What happens if you cancel an addy.io subscription?

Nothing changes until the billing period ends; then the account drops to Free. Custom domains, additional usernames, recipients beyond the first, aliases on paid-only domains and shared-domain aliases beyond ten are deactivated, and the blocklist stops blocking. addy.io’s FAQ says resubscribing within 90 days reverts all of it automatically.

Can you self-host addy.io?

Yes. The whole application is open source under AGPL-3.0 on GitHub. addy.io’s self-hosting guide builds an instance on PHP, Postfix, MariaDB, Redis, Nginx and Rspamd, plus open port 25, reverse DNS, and MX, SPF, DKIM and DMARC records. In practice you are running a full mail server.