Apple Hide My Email is an iCloud+ feature that generates random, unique email addresses which forward to your real inbox. You give the random address to an app, a store, or a newsletter, and Apple relays the mail to you. The sender never sees your actual address, and you can switch any alias off later.
That is the version Apple's support pages will tell you. What they leave out is the part that decides whether the feature is right for a given signup: how the free tier differs from the paid one, what Apple changed about the addresses in mid-2026, and what an alias can and can't protect you from.
How Apple Hide My Email actually works
It is forwarding, not a second mailbox. There is no separate inbox to check. When a message hits [email protected], Apple's relay servers pass it straight through to whatever address your Apple Account uses, and Apple says the message is deleted from those relay servers after delivery, usually within seconds. Apple doesn't read the contents beyond the spam filtering any mail provider has to run.
You can reply from the alias too, so a back-and-forth with a seller doesn't leak your real address halfway through the thread.
The important structural fact: the alias is a pointer at your real inbox. For mail to keep arriving, that pointer has to keep existing, and someone has to keep the mapping between the two. This is the same model as any email alias service. It shapes everything else in this post.
The free version and the paid version are not the same thing
Most confusion about Hide My Email comes from here. There are two of them.
Free, through Sign in with Apple. No iCloud+ needed. The first time you tap "Sign in with Apple" on a site or app and choose to hide your address, Apple mints one alias on the @privaterelay.appleid.com domain and ties it to that one service. You can reply to mail that arrives, but you can't start a new message from it, and you can't generate an address for anything that doesn't offer Sign in with Apple.
Paid, through iCloud+. Any paid iCloud plan includes it, starting at $0.99 a month in the US. Now you can generate addresses on demand from Safari, Mail, Settings, or iCloud.com, use them anywhere including paper forms and checkout pages, and send as well as reply. These were issued on plain @icloud.com. Apple lists iOS 16 or iPadOS 16 for third-party app support and macOS 13 for the iCloud settings panel.
So when someone says "I already have Hide My Email" and then can't work out why they can't create an address for a gym membership form, this is almost always why. They have the free one.
What Apple's 2026 domain change means for Hide My Email
On June 15, 2026, Apple told developers it was collapsing both features onto a single new domain: private.icloud.com. Sign in with Apple addresses move off privaterelay.appleid.com, iCloud+ addresses move off icloud.com, and new addresses on the shared domain began rolling out over the summer. Existing aliases keep working and keep forwarding.
Read that closely, because it undoes the feature's quietest advantage.
The reason Hide My Email worked so well from 2021 onward was that an alias was indistinguishable from a real Apple customer's address. Both ended in @icloud.com. A site that wanted to block masked signups had no way to do it without also blocking every genuine iCloud user who tried to register, which is a price almost nobody was willing to pay. The aliases got through because they had cover.
A single domain that exists only for masked addresses removes the cover. Any site that wants to reject Apple aliases can now block one string and catch all of them at once, with zero collateral damage to real iCloud users. Apple hasn't explained why it made the change. Whatever the reason, it moves Hide My Email closer to the domain blocklists that already catch disposable addresses, and it is the most consequential change to the feature since launch.
Where Hide My Email falls short
None of this makes it a bad tool. It does mean the marketing version oversells it.
Deleting an alias is a two-step, one-way trip
You can't delete an active address. You deactivate it first, then delete it from the inactive list, and deletion is permanent across all your devices with no way to reactivate. Aliases created through Sign in with Apple are managed in a separate place from your iCloud+ ones, which is its own small maze.
There is a ceiling, and Apple won't say where
Apple doesn't publish a cap on how many aliases you can create. Users hit one anyway. Reports on Apple's own forums describe creation failing after a few hundred addresses, including one account stuck at 768. If your plan is a fresh alias for every single signup, budget for the possibility that the well runs dry without warning.
The link back to you is retrievable
In March 2026, unsealed court records showed Apple had given federal agents the subscriber information connecting a Hide My Email alias to the Apple Account behind it, along with records for 134 other aliases on that same account. TechCrunch reported the filings in detail.
This is not a scandal so much as arithmetic. Forwarding requires the provider to hold both ends of the mapping, permanently, or the mail can't be delivered. Every alias-forwarding service works this way. Hide My Email hides you from the website. It was never built to hide you from Apple.
A disclosed flaw sat open for over a year
Tyler Murphy of EasyOptOuts reported a method for unmasking the real address behind a Hide My Email alias in June 2025. Apple said in March 2026 it had addressed the issue; Murphy found it still worked. As of the public disclosure on July 1, 2026, it remained unfixed, and every address tested was reportedly exploitable. Technical details were withheld precisely because the method still worked.
When to use Hide My Email, and when to use a disposable inbox
These solve two different problems, and picking the wrong one is why people end up frustrated with both.
Hide My Email is the right call for accounts you intend to keep. An online retailer you actually order from. A subscription you will need to reset the password on someday. Anything where you want mail to keep reaching you for years while the company never learns your real address. Persistence is the whole point, and forwarding gives you that.
A disposable inbox is the right call for everything you want to end. The one-time verification code. The free trial. The forum you posted in once. The wifi portal at the airport. The download that demanded an address before it would hand over a PDF.
The difference is what happens six months later. An alias keeps forwarding into your real inbox until you go back and turn it off, and if you have made forty of them, you probably won't. A disposable inbox has nothing to turn off. Mail arrives somewhere that is not your inbox, you read the code, the address expires, and the messages are deleted from our servers. Your real address was never part of the transaction, so there is no mapping to unwind and nothing to leak later. That is a structural difference, not a feature comparison. It is also worth knowing the honest limits on both sides, which we cover in are disposable emails traceable.
SecondInbox gives you that second kind in one click, with no Apple Account, no subscription, and no signup. It works on Android, Windows, and anything with a browser, which matters if the reason you are reading this is that Hide My Email is locked to an ecosystem you are not fully inside. If a verification email is slow, you can extend the inbox instead of losing it.
Use both. Aliases for the accounts that matter, a throwaway inbox for the ones that don't. That combination beats either one alone.
Partly. The version built into Sign in with Apple is free and works on sites that offer that button, but it is reply-only and gives you one address per service. Generating addresses freely requires iCloud+, which starts at $0.99 a month in the US.
No. Apple has to keep the mapping between the alias and your real address for forwarding to work, and court records from March 2026 confirm that mapping can be handed to law enforcement on request.
They could always block <code class="inline-code">privaterelay.appleid.com</code>. Blocking iCloud+ aliases used to mean blocking all of <code class="inline-code">@icloud.com</code>, which almost no site would do. Apple's move to <code class="inline-code">private.icloud.com</code> makes those aliases blockable on their own.
Nothing. Apple says existing addresses on the old domains keep working and keep forwarding without interruption. Only newly created addresses use <code class="inline-code">private.icloud.com</code>.
Use Hide My Email for accounts you plan to keep and might need to recover. Use a temporary address for one-off signups, verification codes, and trials, where the goal is for the mail to stop rather than to keep arriving.
The take
Hide My Email is a genuinely good alias tool that Apple has spent 2026 making slightly worse: a domain change that hands sites an easy block list, a year-old unmasking flaw still open at last disclosure, and court records confirming what the architecture always implied about who can undo the mask.
It is still worth using for the accounts you keep. It was never the right tool for the signups you want to be rid of, and it is a worse fit for those than it was a year ago. For those, don't route the mail into your inbox at all.
Keep reading
How to Make a Burner Email That Survives the Signup
Making a burner email takes ten seconds. Making one that survives a slow verification email is the part guides skip. Here's how to do both properly.
Does Gmail Have Disposable Email Addresses? Not Really
No, Gmail has no disposable address feature. Here's what the plus trick actually does, why Google's Shielded Email never shipped, and what to use instead.