Hide My Email on Mac: Create Burner Addresses

Hide My Email is the iCloud+ feature that hands out a random address — something like lantern.spark_0k@icloud.com — to every site that demands one. Mail sent to it forwards to your real inbox; when a site leaks or spams, you kill that one address and nothing else changes.

The fast way: let Safari offer one

If you subscribe to iCloud+ (any tier), the feature is already live. The most natural place to use it is a signup form:

1. In Safari, click into the email field on any registration or newsletter form.
2. Safari's autofill dropdown offers Hide My Email with a freshly generated address. Click it.
3. The address is created, filled into the form, and saved to your account with the site's name attached — mail to it lands in your normal inbox.

The same suggestion appears on iPhone and iPad, and every address you create is visible and manageable from all your devices. Apps that use Apple's standard signup sheet, and anything using Sign in with Apple, offer the equivalent choice as Hide My Email at signup.

Create one manually for anything else

For forms outside Safari — a Chrome signup, a paper form, a person you'd rather not give your real address — mint an address by hand:

1. Open System Settings, click your name at the top, then iCloud.
2. Click Hide My Email.
3. Click the + button. Apple generates a random address; regenerate it if you don't like the look of it.
4. Give it a label (the site or purpose) and an optional note, then click Create Email Address. Copy it wherever you need it.

Labels matter more than they seem: six months later, "hotel-wifi-lisbon" tells you exactly who sold your address when spam starts arriving at it.

Managing, replying, and the forwarding address

The same Hide My Email screen lists every address with its label. Click one to copy it, change where it forwards (any of your verified Apple Account addresses), or turn it off. Two behaviours worth knowing:

• Replies stay masked. When you reply from Mail to a message that arrived via a Hide My Email address, the reply goes out from that random address — the recipient never sees your real one.
• Deactivating is reversible; deleting is not. Deactivate Email Address stops all forwarding but keeps the address yours, and you can reactivate it later from the Inactive list. Deleting an inactive address releases it permanently — do that only for addresses you're sure no account still uses, because you can't recreate the same one.

Its limits, honestly

Hide My Email is for receiving. You can reply to messages that come through it, but it's clumsy as a primary outbound identity — for that, iCloud+ also offers a custom email domain. Addresses only forward while you keep paying for iCloud+: if you cancel, mail to your burner addresses stops being delivered, so don't put one on anything critical like a bank login. And remember the addresses live in your Apple Account, not in the mailbox — signing out of iCloud on the Mac doesn't disable them.

Habits that make it actually work

The system pays off only if you're consistent. Use a fresh address for every site — the whole point is that no two services hold the same one, so a leak is traceable and contained. When spam arrives, open Mail, check which Hide My Email address it came to, and deactivate exactly that one; your other signups are unaffected. Before deactivating, log in to the site concerned and change the account email to a new burner (or your real address, if you now trust them), or you'll lock yourself out of password resets. And skim the Inactive list once a year — anything you're certain is dead can be deleted to keep the list navigable.