What Happened
Brave has shipped a built-in Email Aliases feature in version 1.94 of its browser, released August 29, 2026, giving users a way to generate disposable, forwarding email addresses directly from the browser instead of handing out their real inbox to every site they sign up with.
The feature works by letting a user create an alias — a randomized or custom email address — at the point of registering for a new service. Messages sent to that alias are forwarded to the user's real inbox, while the site on the other end never sees, and can't leak, the actual address.
How It Works
Alias Creation and Forwarding
Aliases are generated on demand when signing up for a new account and act purely as a forwarding layer: mail sent to the alias arrives in the user's real inbox, but the destination address is never exposed to the site the alias was created for. Brave says forwarded messages are deleted from its own servers within seconds, and any alias notes synced across devices are end-to-end encrypted.
Account Security
The feature requires a free Brave Account, which is separate from Brave's paid Premium tier. Authentication for Brave Accounts uses OPAQUE (RFC 9807), a password-authenticated key exchange protocol that never transmits the user's actual password to Brave's servers — a design that mitigates risk from server-side password logging or memory-scraping attacks, though it does nothing to stop phishing or weak/reused passwords.
Availability and Limits
The free tier includes 5 email aliases per account, with a paid tier planned later that removes the cap. Because forwarded mail comes from Brave's infrastructure rather than the sending domain's usual reputation, Brave warns that some early forwarded messages may land in spam folders while its mail servers build up sender reputation with recipient providers.
Impact Assessment
| Impact Area | Description |
|---|---|
| Cross-Site Tracking | Blocks one of the most common identity-matching vectors — a shared email address used to correlate a user's activity across unrelated sites and data brokers |
| Breach Exposure | If a service using an alias is breached, the leaked address is a dead-end alias rather than the user's real inbox, limiting follow-on spam, credential-stuffing, and phishing risk |
| Spam Reduction | Aliases can be abandoned or disabled per-site without affecting the user's primary address |
| Adoption Friction | Requires creating a free Brave Account, and the 5-alias free-tier cap may push heavier users toward a future paid tier |
Recommendations
For Everyday Users
- Use a distinct alias for every new site or service you register with, rather than reusing your real address.
- Treat aliases as disposable — disable or abandon one the moment a site starts sending unwanted mail or shows up in a breach notification.
- Expect forwarded mail to occasionally land in spam while Brave's sending reputation matures; check spam folders after signing up somewhere new.
For Privacy-Conscious Teams
- Email aliasing is a low-effort control against the exact pattern that powers most data-broker profile building: a single email address stitching a person's activity together across otherwise unrelated services.
- This puts Brave in the same space as Apple's Hide My Email and Firefox Relay, but built natively into the browser rather than gated behind a separate subscription or account ecosystem — worth evaluating if your organization already standardizes on Brave for privacy-sensitive browsing.
Key Takeaways
- Brave 1.94 (released August 29, 2026) adds native Email Aliases — disposable forwarding addresses generated at sign-up time.
- Aliases forward to the user's real inbox while keeping that address hidden from the site being signed up for.
- The free tier includes 5 aliases; a paid tier with unlimited aliases is planned.
- Brave Accounts use OPAQUE (RFC 9807) password authentication, which keeps plaintext passwords off Brave's servers.
- Forwarded messages are deleted from Brave's servers within seconds, and synced alias notes are end-to-end encrypted.
- The feature mirrors Apple's Hide My Email and Firefox Relay but is built directly into the browser.