Plus Addressing Explained: Use address+tag for Privacy

Most people have no idea that their email address has a built-in privacy feature hiding in plain sight. It is called plus addressing (also known as subaddressing or tagged addressing), and it lets you create unlimited variations of your email without setting up a single new account.

If your email is [email protected], you can use [email protected], [email protected], or [email protected] — and every message sent to those addresses lands in your regular inbox. The part after the + is a tag you invent on the spot.

It is free, requires no setup, and works with most major email providers. But it also has significant limitations that make it a starting point for email privacy — not a complete solution.

What Is Plus Addressing?

Plus addressing is a feature defined in RFC 5233 (the internet standard for email subaddressing) that allows you to append a +tag to the local part of your email address (the portion before the @ sign). The email server ignores the tag when routing the message and delivers it to your main inbox.

The format is simple:

[email protected]

• yourname — your actual email username
• +anytag — a tag you create (any combination of letters, numbers, hyphens, and underscores)
• @domain.com — your email provider's domain

You do not need to register these tagged addresses. They work instantly. You can create as many as you want, and they all deliver to the same inbox.

Which Email Providers Support Plus Addressing?

Not every provider handles plus addressing the same way. Here is a breakdown of major providers:

If your provider supports it, you can start using plus addressing right now — no settings to change, no features to enable.

Practical Uses for Plus Addressing

Plus addressing is more useful than most people realize. Here are the most effective ways to use it.

Organizing Your Inbox by Service

The most straightforward use is creating a unique tag for every service you sign up for:

• [email protected] for GitHub
• [email protected] for LinkedIn
• [email protected] for Amazon

You can then create email filters that automatically sort messages by the To address. In Gmail, for example:

1. Open Settings and go to Filters and Blocked Addresses
2. Click Create a new filter
3. In the To field, enter [email protected]
4. Click Create filter and choose your action (apply label, skip inbox, etc.)

This gives you automatic organization without relying on sender addresses, which change frequently as companies rotate marketing domains.

Detecting Which Service Leaked Your Email

This is the killer use case for plus addressing. If you use a unique tag for every service and you start receiving spam addressed to [email protected], you know exactly which service sold, shared, or lost your email address.

For example, if you signed up for a newsletter using [email protected] and you start getting pharmaceutical spam sent to that exact address, the leak trail leads directly back to that newsletter.

This technique has exposed data leaks at major companies. Users who practiced tagged email hygiene have been able to pinpoint exactly which service was responsible when their data appeared in a breach.

Signing Up for Multiple Accounts

Some services allow multiple accounts as long as each has a unique email address. Plus addressing lets you create separate accounts without needing separate email addresses:

• [email protected]
• [email protected]
• [email protected]

Each one functions as a distinct email for the service's registration system, but all messages arrive in your single inbox.

Filtering Promotions and Newsletters

Use a dedicated tag for anything likely to generate marketing emails:

• [email protected] for promotional signups
• [email protected] for newsletters

Then create a single filter that catches all +promo messages and routes them to a folder or automatically archives them. This keeps your primary inbox clean without unsubscribing from everything.

The Limitations of Plus Addressing

Plus addressing is useful, but it has real weaknesses that limit its effectiveness as a privacy tool. Understanding these limitations is critical before relying on it.

Many Websites Reject the + Character

This is the single biggest problem with plus addressing in practice. A surprising number of websites do not accept the + character in email fields. Their form validation treats it as an invalid character, even though it is perfectly valid in email addresses per RFC 5321.

Common error messages include:

• "Please enter a valid email address"
• "Email address contains invalid characters"
• "The + character is not allowed"

Some sites reject the plus sign deliberately — they know about plus addressing and want to prevent users from creating multiple accounts or using tagged emails. Others reject it accidentally because their email validation regex is too restrictive.

In either case, the result is the same: you cannot use plus addressing on a significant percentage of websites. Estimates vary, but anecdotally 20-30% of websites reject email addresses containing a plus sign.

Sites Can Trivially Strip Your Tag

Even when a site accepts your plus-addressed email, they can easily extract your real email address. Stripping everything between + and @ is a single line of code in any programming language:

[email protected] → [email protected]

Some companies do this intentionally to de-duplicate users or to normalize email addresses in their database. Others do it as part of data cleaning processes. Either way, your tag — and the privacy or organization benefit it provided — disappears.

This means plus addressing offers zero protection against a service that actively wants to identify or de-duplicate your real address.

Your Real Address Is Always Visible

Unlike email aliases or disposable email services, plus addressing does not hide your real email address. Anyone who sees [email protected] can immediately determine that your actual address is [email protected].

This is a fundamental limitation. Plus addressing is transparency with a thin layer of organization on top — not actual privacy. A data broker who obtains your plus-addressed email has your real address too.

Tags Provide No Protection After a Breach

If a service that has your plus-addressed email suffers a data breach, attackers get your real address along with the tag. The tag tells you which service was breached (useful for detection), but it does nothing to protect you from the fallout. Attackers will simply strip the tag and target your real inbox.

Compare this with a disposable email address, where a breach exposes only the temporary address — your real inbox remains completely unknown and untouched.

When Plus Addressing Is Not Enough

Plus addressing works well for organization and basic leak detection, but there are clear situations where you need something stronger.

When You Need True Privacy

If your goal is to keep your real email address completely hidden from a service, plus addressing cannot help. The service can see your real address, strip the tag, and store the base address. You need either an email alias (which forwards to your real address but hides it) or a disposable email (which has no connection to your real address at all).

When a Site Rejects the + Character

If a website will not accept your plus-addressed email, you have two options: give them your real address, or use a disposable email service. For one-time signups, free trials, or sites you do not trust, a disposable inbox is the practical choice.

When You Want Breach Isolation

Plus addressing tells you who leaked your email. Disposable email prevents the leak from affecting you at all. If breach protection is your priority — not just breach detection — you need separate addresses that do not trace back to your real inbox.

Plus Addressing vs. Aliases vs. Disposable Email

Each approach to email privacy has different strengths. Here is how they compare:

The three tools are complementary, not competing. The strongest email privacy strategy uses all three depending on the situation.

Step-by-Step: Setting Up a Plus Addressing System

If you want to start using plus addressing systematically, here is a practical workflow.

Step 1: Choose a Tagging Convention

Consistency matters. Pick a naming scheme and stick with it. Good options include:

• Service name — [email protected], [email protected]
• Category — [email protected], [email protected]
• Date-based — [email protected] (useful for time-based tracking)
• Combined — [email protected]

The service name approach is the most useful for leak detection since it pinpoints exactly which service is responsible.

Step 2: Create Filters for Organization

Set up inbox rules that sort messages based on the To address:

• All +shopping messages go to a "Shopping" label
• All +social messages go to a "Social" label
• All +promo messages skip the inbox and go to a "Promotions" folder

Most email providers support filtering by the To or Delivered-To header.

Step 3: Keep a Record

Maintain a simple list — a spreadsheet or note — of which tag you used for which service. This is essential for leak detection. If you receive unexpected email to a tagged address, check your list to identify the source.

Step 4: Have a Fallback Ready

When a website rejects your plus-addressed email (and it will happen), have a fallback plan. This is where a disposable email service like ExpressMail fits in. Instead of surrendering your real address, open ExpressMail, grab a temporary inbox, complete the signup, get the verification code, and move on — no plus sign needed, no real address exposed.

Step 5: Audit Periodically

Every few months, review your tagged addresses:

• Are any receiving unexpected spam? Investigate the leak.
• Are there services you no longer use? Consider changing the associated email or closing the account.
• Are any tags being stripped? You may notice a service sending to your base address instead of the tagged one — a sign they normalized your email.

The Best of Both Worlds

Plus addressing and disposable email are not an either/or choice. They work best together:

• Use plus addressing for services you trust and plan to use long-term. The organization and leak detection benefits are real, and the convenience of a single inbox is hard to beat.
• Use disposable email (like ExpressMail) for one-time signups, untrusted sites, and any service that rejects the + character. Your real address stays completely hidden, and the temporary inbox handles the throwaway interaction.
• Use email aliases for the middle ground — services you will use regularly but want an extra layer of separation from your real address.

Plus addressing is a free, zero-setup trick that everyone with a Gmail, Outlook, or ProtonMail account should be using. But it is a starting point, not a destination. When you need real privacy — not just organization — a disposable inbox picks up where the plus sign leaves off.