Brave Email Aliases Give You 5 Free Burner Inboxes

The Identifier Ad Blockers Cannot Touch

Brave shipped Email Aliases in desktop version 1.94 on August 27, 2026. The feature generates a unique forwarding address at the moment you click an email field on a signup form, so the site gets an alias and your real inbox stays out of its database.

• Five free aliases in the initial release, generated inline from the email field on any signup form
• Desktop only for now, in Brave 1.94, with mobile support in development and a Premium tier planned
• Brave Accounts use OPAQUE, a password-authenticated key exchange standardized as RFC 9807, so the password never reaches Brave's servers
• Forwarded mail is not read — Brave processes it only for spam and virus filtering, then deletes it from its servers after forwarding

Why an Email Address Is a Tracking Cookie That Never Expires

This is the part worth understanding, because it explains why a browser company is building a mail feature at all.

Browser privacy work has spent fifteen years getting very good at the identifiers browsers control. Third-party cookies get blocked. Fingerprinting surfaces get randomized. Storage gets partitioned per site. Brave has been among the more aggressive implementers of all three.

An email address defeats every one of those defences, because it does not live in the browser. You hand it over voluntarily at signup, it is identical across every site you give it to, it survives cache clears and new devices, and it is trivially joinable with the same address held by any other company. As a cross-site identifier it is close to ideal, which is precisely the problem.

Aliasing breaks the join. Each site gets a different string, so nobody can match your account on one service to your account on another. If an alias starts receiving mail you did not sign up for, you also learn something concrete about which site shared it — the sort of forensic clarity that is normally impossible with a single address.

Is OPAQUE Actually Meaningful Here?

Yes, and it is the detail that separates this from a bolt-on. Introducing an account system to a privacy browser is a genuine tension: the account becomes a new identifier and a new thing to breach. Brave's answer is to build it on OPAQUE, an augmented password-authenticated key exchange standardized as RFC 9807 in July 2025.

Under OPAQUE the password is never transmitted. The client and server run an oblivious pseudorandom function to derive authentication material, and the server ends up able to verify you without ever holding anything that could be cracked back into your password. A server-side breach yields no password database to attack offline, because there is nothing password-shaped stored there.

That property matters more for a mail-forwarding service than for most accounts, since compromising it would expose the mapping between aliases and the real inbox — the exact linkage the feature exists to prevent. Choosing a protocol that removes the credential from the server is the right structural answer, and it is a pattern we keep seeing in the strongest AI security and privacy work, including WhatsApp taking passkeys multi-device for a billion users.

Five Aliases and the Honest Caveats

Five is enough to protect the accounts you actually care about and not enough to alias everything, which is clearly the intent of a free tier with Premium to follow. Desktop-only is a real limitation while it lasts, since a fair share of signups happen on a phone.

The larger caveat is the standard one for any forwarding service: you are moving trust rather than eliminating it. Brave's stated policy is that it processes forwarded mail only for spam and virus filtering and deletes it after forwarding, and the OPAQUE-backed account design is consistent with a company that means it. Users comfortable with self-hosted alternatives will still prefer running their own domain, an approach our self-hosted infrastructure guides tend to favour. For everyone else, five free aliases built into the browser they already use removes essentially all of the friction that has kept aliasing a niche practice.

Sources: Brave — August 27, 2026; TechCrunch — August 28, 2026; BleepingComputer — August 29, 2026.