Brave has started handing out throwaway email addresses from inside its browser, a feature meant to stop sign-up forms from feeding the same identifier to ad platforms over and over. Email Aliases arrived with desktop version 1.94 last Thursday, and the browser now offers to generate a random forwarding address whenever a user clicks into an email field.
The pitch targets a kind of tracking that Brave’s existing blockers can’t touch. In its announcement, the company noted that Google, Meta and LinkedIn all promote tools that let businesses upload customer email addresses and match them against their own user profiles. A retailer that runs Meta ads can send a shopper’s address to Meta’s server-side matching tool, and if that address is already tied to an old Facebook account, Meta learns about the purchase. “Since it’s happening server-side, none of this traffic goes through your browser, so blocking trackers on the page can’t prevent this action,” Brave wrote.
Breaches are the other worry. “If a website you signed up for is hacked, your information can be leaked and end up with data brokers or worse,” wrote Shivan Kaul Sahib, Brave’s vice president of privacy and security. “Your email address then circulates far beyond the company you originally trusted with it, and can show up in phishing campaigns for years afterwards.”
How the aliases work
Using the feature requires a new Brave Account, set up at brave://settings/email-aliases with an email address and password. That account is separate from the Brave Premium login used for paid services like the Brave VPN, and it relies on the OPAQUE protocol, so the password itself is never sent to Brave’s servers. Mail sent to any alias is forwarded to the address on the account.
Once signed in, a “New Email Alias” prompt appears in sign-up forms; if it doesn’t, a right-click on the field brings up the same option. Aliases can be listed, annotated and deleted under Settings > Autofill & Passwords > Email Aliases. Deactivating one and creating a fresh address is also Brave’s suggested fix for spam.
Brave said it stores the account address and generated aliases encrypted at rest, doesn’t read message contents, and scans mail only for spam and viruses, which it says it must do to keep its standing as a reputable mail provider. Delivered messages are deleted from its servers within seconds. Notes attached to an alias stay on the device, and with Brave Sync turned on they’re end-to-end encrypted between devices.
The company frames the feature as an extension of its per-site partitioning of cookies, caches and network state. That partitioning “stops at the edge of the browser,” Brave wrote, and can’t keep two companies from comparing notes on their own servers.
Five free, more later
Everyone gets five aliases at no charge for now. Brave said running a forwarding service has ongoing costs, so it is starting small while it studies how people use the feature, and it plans a Premium version later. Mobile support is in the works; the launch covers desktop only.
Early forwarded mail may land in spam folders while Brave builds its reputation as a sender, and the company asked users to mark such messages “not spam.” TechCrunch said Brave had added “a good reason to make the switch to its browser”, and BleepingComputer focused on the tracking-evasion angle.
One wrinkle for Brave Origin users: the feature shows up as a Settings toggle for people who upgraded an existing Brave install, but it won’t appear in the standalone Origin download.
WebProNews is an iEntry Publication