Anonymous Email: A Beginner’s Guide to the Real Trade-offs

FOUNDATIONS

A Beginner’s Guide to Anonymous Email: Terms, Tools, and Trade-offs

“Anonymous email” is a phrase doing far too much work. It gets applied to encrypted providers, to throwaway inboxes, to forwarding aliases and to accounts opened under a false name — four things that protect against completely different threats and fail in completely different ways. Sorting out the vocabulary is not pedantry here. It’s most of the job.

Four words that aren’t synonyms

Start here, because every later decision depends on it.

Most services marketed as “anonymous” deliver confidentiality or pseudonymity. Genuine anonymity is rarer and harder than the word suggests.

The distinction that trips people most often is the last one. A pseudonym accumulates history: every message under the same handle joins a growing pile that can eventually be matched to a person through a single slip. Anonymity means there is no pile — no thread from this message to the last one.

What an email reveals before anyone reads it

Every message carries a header block that exists so the mail system can route and troubleshoot it. You rarely see it, but it travels with the message and it is descriptive.

An illustrative header block. Each “Received:” line records a hop, building a trail back toward the origin.

Now the part that surprises people: encrypting the message does not encrypt any of that. Documentation for OpenPGP puts it plainly — the headers of the email, including the sender, recipients, date and time, server details and the subject line, are not encrypted. They can’t be, because the mail system needs them to deliver the message at all. The standard advice that follows is worth internalising: never put anything confidential in the subject line of an encrypted email.

So a perfectly encrypted message still announces who corresponded with whom, when, how often, and through which infrastructure. That is a great deal of information. In many contexts it is more revealing than the contents would be.

The tools, and what each actually protects

With the vocabulary settled, the landscape becomes much easier to read.

No row protects everything. Combinations exist, but every added layer is another thing to get right.

Read down the “does not protect” column and a pattern emerges. Content protection is a solved problem. Metadata protection is the hard one, and almost nothing in ordinary email addresses it.

The case that shows where the line really is

Abstract explanations of this get argued about. A documented incident doesn’t.

In 2021, French police investigating a group of activists in Paris sought account information from Proton Mail. The request travelled through Europol to Swiss authorities, who made a formal legal demand under Swiss law. Proton complied — logging and handing over the account’s IP address, its creation date, and device information.

What Proton did not hand over was the mail itself. Because the service uses end-to-end encryption, it does not hold readable message contents and could not produce them under any order. Proton’s chief executive framed the compliance as unavoidable: Swiss law obliges the company to answer lawful requests from Swiss authorities in a criminal investigation, and the routing through two countries’ authorities set a meaningful bar.

It also demonstrates a point worth stating without hedging: none of these tools is designed to defeat a lawful investigation, and treating them as though they are is a mistake with consequences. The realistic use of email privacy tooling is reducing commercial surveillance and casual exposure — which is a worthwhile goal in itself, and the one nearly everyone reading this actually has.

The question that comes before the tools

Security people call this threat modelling, which sounds more elaborate than it is. It’s one question: anonymous from whom?

The top two rows describe almost everyone’s real situation, and both are cheap to solve.

Most people who search for “anonymous email” want row one. They are tired of a decade of newsletters and uneasy about their address circulating between companies they never dealt with. That problem is genuinely solvable with an alias or a disposable inbox and about ten seconds of thought per sign-up.

Five things that quietly undo it

Anonymity almost never fails because cryptography broke. It fails through ordinary mistakes.

Reusing the address. Use a “private” address in two places and you’ve built the link yourself. One address per context, or the whole exercise is decorative.

Connecting from your usual network. The service sees your IP. If that IP also serves your everyday accounts, the separation is thinner than it looks.

Attachments that talk. Photos can carry camera and location data; office documents routinely embed an author name and revision history. Files leak identity independently of the mail carrying them.

Linked recovery details. Attaching a recovery phone number or backup address that’s tied to you connects the “anonymous” account to the real one, permanently, in the provider’s records.

The content itself. Naming your employer, your city, or an unusual detail identifies you regardless of the address. So, over enough messages, can a distinctive writing style.

Frequently asked questions

Does encrypted email make me anonymous?

No. Encryption provides confidentiality — it stops others reading the contents. It doesn’t hide who sent the message, who received it, when, or through which servers. With OpenPGP the headers, including sender, recipients, date and time, server details and the subject line, aren’t encrypted, because encrypting them would break delivery.

Is Proton Mail anonymous?

It’s confidential rather than anonymous, and a real case makes the distinction concrete. In 2021, following a request routed from French police through Europol to Swiss authorities, Proton logged and handed over a user’s IP address, account creation date and device information. It couldn’t hand over message contents, because end-to-end encryption meant it didn’t hold them.

What’s the difference between pseudonymity and anonymity?

A pseudonym is a consistent identity that isn’t your legal name — a handle people recognise across messages. Anonymity means there’s no thread connecting one message to another or to you. Most things described as anonymous online are actually pseudonymous, and the difference matters because a pseudonym accumulates a history.

What accidentally breaks email anonymity?

Reusing an address in two places, connecting from your usual home network, attaching files carrying authorship or location metadata, linking a recovery address or phone tied to you, and writing in a recognisable way about identifying details. Most failures are ordinary mistakes, not broken cryptography.

Do I actually need anonymous email?

Most people don’t. What they usually want is to stop companies, data brokers and advertisers building a durable profile around a permanent address — an easier problem, solved well by aliases and disposable inboxes. Genuine anonymity against a determined adversary is difficult, easy to get wrong, and rarely what the situation calls for.

The bottom line

If you take one idea from this, make it the split between content and metadata. Encryption handles content and handles it well. Metadata — who, whom, when, from where — is what ordinary email tooling barely touches, and it’s where both the surveillance economy and the 2021 Proton case actually operate.

The good news is that the threat nearly everyone faces lives at the easy end. You are not up against a state; you are up against a marketing database that wants one stable identifier to organise itself around. Refusing to supply that identifier — with an alias where the mail matters, a disposable address where it doesn’t — solves the real problem without requiring you to become a different kind of person about your email.