Email Aliasing: SimpleLogin vs addy.io

addy.io wins on price and on the self-hosted path. SimpleLogin wins the moment you already pay Proton, because Premium now bundles Proton Pass.

You’re tired of spam, tired of your real address sitting in every breach dump, tired of marketing lists that got you three hops removed from wherever you actually signed up. You’re also not about to abandon email for some decentralized-everything utopia. You just want a buffer.

Email aliasing is that buffer. Each signup gets its own forwarding address. If one starts attracting junk, you kill that address and nothing else changes.

Two names dominate: SimpleLogin, owned by Proton since 2022, and addy.io, written and run by Will Browning, a UK developer who has kept it independent. Both are AGPL-3.0 open source, both are self-hostable, and both have hosted tiers. Where they part ways is the free tier and the price of the paid one.

Which alias service should you actually use?

Prices and limits verified against both vendors’ own signup pages in September 2026. They move, so check before you commit.

The two free tiers fail in opposite directions. SimpleLogin gives you replies and unlimited bandwidth but stops dead at 10 aliases. addy.io gives you unlimited aliases and no replies at all, then throttles you at 10 MB of forwarded mail per month, which one newsletter with a PDF attachment can eat.

The problem email solved, then created

Email was supposed to be one address for life. Then the web exploded, and that one address became a skeleton key: newsletters, five competing SaaS accounts, a forum you used once in 2009. Every one of those sites now holds it, and some of them sell it, get breached, or both.

So you do what everyone does. You make a second address. Then a third. Now you manage five inboxes, two of which forward to a Gmail you abandoned in 2014.

Aliasing puts a filter layer in between instead. Each signup gets a unique address that forwards to your real inbox. When [email protected] starts receiving offers for solar panels, you know exactly who leaked it, and you switch that one address off.

SimpleLogin: the Proton bundle

SimpleLogin is Swiss, owned by Proton, and open source down to the browser extensions and mobile apps. The back end lives at github.com/simple-login/app under AGPL-3.0, and the self-hosting instructions are in that repo’s README.

Free tier: 10 aliases, 1 mailbox, unlimited bandwidth, reply and send from any alias, TOTP and WebAuthn on the account, browser extensions for Chrome, Firefox and Safari, iOS and Android apps.

Premium, $36 per year or $4 per month: unlimited aliases, unlimited custom domains, catch-all, 5 subdomains, 50 directories, unlimited mailboxes, PGP encryption of forwarded mail. Since the Proton merger, Premium also carries Proton Pass premium: vaults, secure link sharing, built-in 2FA, dark web monitoring.

That bundle is the real argument for SimpleLogin. If you were going to buy a password manager anyway, $36 covers both.

The sharp edges:

• The 10-alias free cap is low if you intend to generate an address per signup. Two months of ordinary browsing puts you over.
• Cancelling Premium does not break existing aliases. Proton’s own FAQ says every alias, domain, directory and mailbox keeps forwarding and replying. You just cannot create new ones past 10, and catch-all stops auto-creating.
• You are trusting Proton. Good jurisdiction, published track record, still one company holding the mapping between every alias and your real inbox.

addy.io: the independent one

addy.io started life as AnonAddy. It is a Laravel application, AGPL-3.0, and the hosted service runs the same code you can install yourself.

Free tier: unlimited standard aliases on [email protected], 10 active shared-domain aliases, 1 recipient address, 2 alias domains, 10 MB of monthly bandwidth. GPG/OpenPGP encryption per recipient, including encrypted subject lines. Browser extension for Firefox, Chrome, Edge, Safari and Chromium forks. Open-source iOS and Android apps, free on every plan including self-hosted.

Lite, $1 per month billed yearly: 1 custom domain, 5 recipients, 5 additional usernames, 5 rules, 50 anonymous replies or sends per day, 100 MB bandwidth, sender blocklist, regex alias auto-creation.

Pro, $3 per month billed yearly or $4 billed monthly: 20 custom domains, 30 recipients, unlimited shared-domain aliases, 200 replies per day, unlimited bandwidth.

There are also Duo ($4.50 per month billed yearly, 2 people) and Family ($7.50 per month billed yearly, 5 people) plans, where one subscription gives everybody their own independent Pro account and an optionally shared custom domain. At $1.50 per person per month, Family is the cheapest per-head aliasing either vendor sells.

The sharp edges:

• Replying from an alias is paid-only. On free you can receive and nothing else, which rules out any address you might need to answer.
• 10 MB per month on the free tier is the limit people actually hit, and it is not obvious until forwarding stops.
• One developer. He has shipped consistently for years and the code is public, but the bus factor is one.

Hosted or self-hosted? That is the real question

The pick between the two matters far less than whether you run it yourself, and self-hosting an alias service means running a mail server. Inbound port 25, SPF, DKIM, DMARC, reverse DNS, and a sending reputation you build from zero. A residential IP will not work; every large provider blocks those ranges outright.

If you self-host anyway, here is what each one asks of you.

Self-hosting addy.io

The official image is anonaddy/anonaddy, maintained by crazy-max. It is not a bare app container: it bundles Nginx, PHP-FPM, Postfix and Rspamd under s6-overlay, so a single container terminates SMTP and serves the dashboard. It needs MySQL or MariaDB. There is no PostgreSQL support, so do not reach for the postgres image out of habit.

name: addy

services:
  db:
    image: mariadb:12
    command:
      - "mariadbd"
      - "--character-set-server=utf8mb4"
      - "--collation-server=utf8mb4_unicode_ci"
    volumes:
      - "./db:/var/lib/mysql"
    environment:
      MARIADB_RANDOM_ROOT_PASSWORD: "yes"
      MYSQL_DATABASE: addy
      MYSQL_USER: addy
      MYSQL_PASSWORD: change_me
    restart: always

  redis:
    image: redis:8-alpine
    restart: always

  addy:
    image: anonaddy/anonaddy:1.7.1
    depends_on: [db, redis]
    ports:
      - "25:25"      # inbound SMTP
      - "8000:8000"  # dashboard, put a reverse proxy in front
    volumes:
      - "./data:/data"
    env_file: ./addy.env
    environment:
      DB_HOST: db
      DB_DATABASE: addy
      DB_USERNAME: addy
      DB_PASSWORD: change_me
      REDIS_HOST: redis
    restart: always

Three variables are mandatory and the container will not come up without them:

# echo "base64:$(openssl rand -base64 32)"
APP_KEY=base64:REPLACE_ME
APP_URL=https://alias.example.com

# Root domain that receives mail
ANONADDY_DOMAIN=example.com
ANONADDY_HOSTNAME=mail.example.com

# Long random string, used to hash anonymous reply addresses
ANONADDY_SECRET=REPLACE_ME

ANONADDY_ADMIN_USERNAME=admin
ANONADDY_ENABLE_REGISTRATION=false

# Bytes, not "10GB". 104857600 is the 100MB default.
ANONADDY_BANDWIDTH_LIMIT=10737418240
ANONADDY_NEW_ALIAS_LIMIT=50

MAIL_FROM_ADDRESS=[email protected]
PUID=1000
PGID=1000

Two traps. ANONADDY_BANDWIDTH_LIMIT is a byte count, so 10GB is not a value it accepts. And the ./data volume must be owned by the PUID/PGID you set, or the container exits during startup without a clear reason.

DNS is the same shape as any mail server:

example.com.        MX  10 mail.example.com.
mail.example.com.   A   203.0.113.10
example.com.        TXT "v=spf1 mx -all"

Generate the DKIM keypair with the bundled anonaddy command and publish the public key as a TXT record. Skip that and everything you forward lands in spam.

Self-hosting SimpleLogin

SimpleLogin is more moving parts, and its README is honest about that. Postfix runs on the host, not in a container, with postfix-pgsql so it can query the SimpleLogin database directly for relay domains and transport maps. Nginx and certbot also live on the host. Then five container invocations off the same image:

# One-shot: schema migration, then seed data
docker run --rm --name sl-migration --network sl-network \
  -v $(pwd)/simplelogin.env:/code/.env \
  simplelogin/app:3.4.0 flask db upgrade

docker run --rm --name sl-init --network sl-network \
  -v $(pwd)/simplelogin.env:/code/.env \
  simplelogin/app:3.4.0 python init_app.py

# Long-running: web app, email handler, job runner
docker run -d --name sl-app       -p 127.0.0.1:7777:7777   ... simplelogin/app:3.4.0
docker run -d --name sl-email     -p 127.0.0.1:20381:20381 ... simplelogin/app:3.4.0 python email_handler.py
docker run -d --name sl-job-runner                         ... simplelogin/app:3.4.0 python job_runner.py

Note the tag. 3.4.0 is what the official instructions pin, and it is the newest non-beta tag on Docker Hub; every 4.x tag published so far is marked beta. Do not put :latest on a mail server.

You generate the DKIM key by hand before any of that runs:

openssl genrsa -out dkim.key -traditional 1024
openssl rsa -in dkim.key -pubout -out dkim.pub.key

1024 bits, deliberately, because some registrars mangle a 2048-bit key in a TXT record.

The honest summary: addy.io self-hosts in one compose file plus a reverse proxy. SimpleLogin self-hosts in a compose file plus host Postfix, host Nginx, host certbot and five containers. Both are documented. Only one of them is a Sunday afternoon.

The alias workflow, once it’s running

Same on either service.

1. Hit the browser extension while a signup form is open.
2. It generates [email protected] and fills the field.
3. Confirm the email, which lands in your real inbox by forwarding.
4. Label the alias in the dashboard so you know what it was for.

Both let you deactivate an alias (mail is silently discarded, no bounce) or delete it (senders get a bounce). Deactivate first. A bounce tells a spammer the address was real and is now dead, which is more information than a silent drop.

Both are supported natively by Bitwarden’s alias generator, so you can mint the alias from inside the password manager at the moment you generate the password.

The catch-all gotcha

Both support catch-all: [email protected] reaches you without pre-creating the alias. Convenient, and it quietly undoes the reason you started.

A catch-all accepts mail addressed to typos, to dictionary guesses, and to every address a spammer sprays at your domain. You cannot switch off an address you never created, so the only lever left is switching off catch-all entirely, which breaks the good aliases along with the bad. Use catch-all on a domain you hand to humans. Use generated aliases everywhere a form asks.

Which one?

• “I want to self-host.” addy.io. One compose file against five containers plus host Postfix is not a close call.
• “I’m already paying Proton.” SimpleLogin. Premium bundles Proton Pass, so the marginal cost of aliasing is zero.
• “I want the cheapest paid tier.” addy.io Lite at $12 a year, or Family at $90 a year split five ways.
• “I want free, forever, and I reply to things.” SimpleLogin free. It is the only free tier of the two that lets you reply, and 10 aliases covers the accounts that matter.
• “I want free, forever, and I only receive.” addy.io free, and watch the 10 MB monthly ceiling.

For most people: start on addy.io free, see whether you hit the bandwidth cap or need to reply, and pay the $12 when you do. If you land in Proton for other reasons later, SimpleLogin is already waiting there.

The bottom line

Aliasing is one of the cheapest privacy wins there is. Five minutes to set up, no change to how you read mail, immediate reduction in what a breach costs you.

SimpleLogin is the bundled play if Proton is already your stack. addy.io is the cheaper one and the easier one to run yourself. Both are AGPL, both let you leave, and either beats handing your real address to a form you’ll regret.

Your 2 AM self will appreciate not sorting through a compromised inbox because a shopping site from 2019 got popped.

Common Questions

Does SimpleLogin have a free tier with unlimited aliases?

No. SimpleLogin’s free tier caps you at 10 aliases and 1 mailbox, though it does include replying from aliases and unlimited bandwidth. Unlimited aliases requires Premium at $36 per year. addy.io’s free tier gives unlimited aliases on your own subdomain but no replies and 10 MB monthly bandwidth.

Is SimpleLogin still open source after the Proton acquisition?

Yes. SimpleLogin’s back end, web app, browser extensions and mobile apps remain AGPL-3.0 at github.com/simple-login/app, and Proton still publishes self-hosting instructions in that repository. The acquisition changed ownership and added a Proton Pass bundle to Premium. The license is unchanged.

Can I self-host addy.io with PostgreSQL?

No. The official anonaddy/anonaddy image supports MySQL and MariaDB only, and its documented variables are DB_HOST, DB_DATABASE, DB_USERNAME and DB_PASSWORD against port 3306. Pointing addy.io at a PostgreSQL container fails at migration. SimpleLogin is the one that runs on PostgreSQL.

What happens to my aliases if I stop paying?

On SimpleLogin, every existing alias, domain, mailbox and directory keeps forwarding and replying. You just cannot create new ones beyond the 10-alias free limit. On addy.io, dropping to free removes custom domains and the ability to reply, so aliases on a custom domain stop working.

Do I need my own domain to use email aliasing?

No. Both services give you a free subdomain: [email protected] on addy.io, or SimpleLogin’s shared domains. A custom domain costs money on both (SimpleLogin Premium at $36 per year, addy.io Lite at $12 per year) and buys portability: your aliases survive a switch between services.

Related Reading

• Self-Hosted Email Aliasing on Your Own Domain
• Self-Hosted Email Is Probably a Bad Idea
• Self-Hosted Email 2026: Mailcow vs Mailu vs Stalwart
• Self-Hosted Email Gateways in 2026
• Vaultwarden vs Bitwarden: Own Your Passwords Before Someone Else Does