Your email address is the backbone of your digital identity. It's used to reset passwords, receive sensitive documents, and verify your identity across hundreds of services. Protecting it is non-negotiable. Here's how to do it right.
Why Email Security Matters So Much
If an attacker gains access to your email, they effectively have access to every account linked to that email — because almost every "forgot password" flow sends a reset link to your inbox. Email security is not just about email; it's about everything.
Choose a Secure Email Provider
Not all email providers offer the same security and privacy protections. Consider switching if you rely on a provider with weak security:
- ProtonMail — End-to-end encrypted, based in Switzerland, free plan available
- Tutanota — End-to-end encrypted, open source, free plan available
- Fastmail — Strong security, no ads, paid service
- Gmail — Good security features but scans content for advertising
Use Email Aliases to Protect Your Real Address
An email alias is a forwarding address that delivers mail to your real inbox. You give websites an alias instead of your real address. If that service is breached or starts spamming you, you delete the alias — your real address stays clean.
- SimpleLogin — Free plan with 10 aliases, open source
- AnonAddy — Free plan with unlimited aliases, open source
- Apple Hide My Email — Built into iPhone/Mac for iCloud users
💡 Best practice: Use a unique alias for every service you sign up for. When a breach happens, you'll know exactly which service leaked your data.
Essential Email Security Settings
- Enable 2FA on your email account — this is the most critical step
- Review and revoke apps with access to your email regularly
- Use a strong, unique password managed by a password manager
- Enable login activity monitoring to detect unauthorized access
- Turn on spam filtering and phishing protection
Recognizing Phishing Emails
Phishing is the most common attack vector targeting email users. Always verify:
- The sender's full email address (not just the display name)
- Whether the request creates urgency or fear
- Links by hovering before clicking (check the real URL)
- Whether you were expecting this email
Stop Email Tracking Pixels
Many marketing — and even personal — emails contain a tiny, invisible tracking pixel: a 1×1 image that silently reports when you open the message, what device you used, and roughly where you are. It is how senders know whether you read an email before you ever reply. You can neutralize most of this by turning off automatic loading of remote images, a single setting in Gmail, Apple Mail, Outlook, and others. Images then load only when you choose, and trackers stay blind until then.
What to Do If Your Email Is in a Data Breach
Sooner or later, an address you use will surface in a breach from some service you signed up with years ago. The response is simple but urgent: change that account's password immediately, and change it anywhere else you reused the same one. Enable two-factor authentication on the affected account, and watch for phishing that references the breached service by name. Free tools let you check which breaches your address has appeared in, so you can act on specifics rather than guessing.
The deeper fix is prevention: a unique password per account means one breach can never cascade into others, and a password manager makes that practical instead of overwhelming.
When to Encrypt Your Emails
Standard email is more like a postcard than a sealed letter — it can be read at several points along its journey. For everyday messages this is fine, but for genuinely sensitive material such as legal documents, medical records, or financial details, end-to-end encryption keeps the contents readable only by you and your recipient. Providers like Proton Mail and Tutanota build this in automatically between their users, and standards like PGP allow encryption across different providers for those who need it.
Separate Emails for Separate Roles
Using one address for everything ties your banking, social media, shopping, and newsletters into a single point of failure. A simple, powerful habit is compartmentalizing: one address for financial and government accounts, another for everyday sign-ups, and a disposable alias for anything likely to generate spam. If the throwaway address is breached or sold, your important accounts remain untouched.
Frequently Asked Questions
Check how your email address looks to attackers with our free Privacy Check tool.