Masked email
In progress
A masked email is an alias like [email protected] that forwards to your real inbox. Giving each site its own alias keeps your real address private, makes spam traceable, and lets you turn off one alias without affecting anything else.
Providers
Section titled “Providers”Octa Pass connects to the provider you already use, with your own API token. The token is stored encrypted in your vault, like a password, and syncs to your other devices. Calls go straight from your device to the provider: the Octa Pass server never sees the token or your aliases.
| Provider | API | Web vault | Extension | Desktop and mobile apps |
|---|---|---|---|---|
| SimpleLogin (also self-hosted) | REST, API key | Yes | Yes | Yes |
| addy.io (also self-hosted) | REST, API token, alias domain | Yes | Yes | Yes |
| Fastmail Masked Email | JMAP, API token with the Masked Email scope | Yes | Yes | Yes |
| Forward Email | REST, API token, your domain | Yes | Yes | Yes |
| Firefox Relay | REST, API token | No | Yes | Yes |
| DuckDuckGo Email Protection | API token | No | Yes | Yes |
Browsers only let a web page call another site’s API when that site allows it (CORS). Firefox Relay and DuckDuckGo don’t, so they can’t be used from the web vault. You can still connect them there; use them from the extension or the apps. The extension already has access to the sites it fills, so connecting a provider asks for no new permission. The apps call these two providers from their native side, and only the providers’ own API addresses.
A self-hosted SimpleLogin or addy.io server needs an https:// address, and must allow calls from the web vault’s address if you want to use it there.
Proton Pass aliases will be added when a public API exists.
Connecting a provider
Section titled “Connecting a provider”- Make an API token in your provider’s account settings. For Fastmail, give the token the Masked Email scope.
- In the web vault or an app, open Masked email; in the extension, open Settings.
- Pick the provider, paste the token, and for addy.io and Forward Email enter the domain new aliases should use. Select Connect.
Disconnect removes the token from your vault. Aliases you already made keep working; manage them with your provider.
Using it
Section titled “Using it”- On sign-up forms (extension): in an email field, choose Use a masked email from the Octa Pass menu. The extension makes a new alias with the site’s domain as its description and fills it in. When you then save the login (or use a suggested password), the login is saved with the alias as its username and its recovery email, linked to the provider. Without a connected provider, the entry shows Needs setup.
- In the item editor: the mail button next to Username makes an alias for the login’s first website and uses it as the username and recovery email. The one next to Recovery email sets only the recovery email.
- In the generator: Make a masked email creates an alias for any website and lets you copy it.
- Aliases in use (on the Masked email page) lists each alias your logins use, with its provider and the logins that use it. It is built from the recovery map on your device.
The first connected provider that works where you are is used, unless you pick another one in the generator.
Turning an alias off or deleting it
Section titled “Turning an alias off or deleting it”Aliases in use has Turn off, Turn on and Delete for each alias, in the web vault and the desktop and mobile apps. The request goes straight from your device to the provider, with your token.
- Turn off stops mail to the alias, and Turn on starts it again. The list is built from your vault, not from the provider, so it can’t show whether an alias is on right now. Both buttons are always there, and pressing one twice changes nothing.
- Delete asks first, then has the provider delete the alias. The login keeps the address as plain text, because that’s still what the site has on record. Only its link to the alias goes, and it drops off the list. If you still sign in with that address, change it on the site first.
| Provider | Turn off and on | Delete |
|---|---|---|
| SimpleLogin, addy.io, Fastmail, Forward Email, Firefox Relay | Yes | Yes |
| DuckDuckGo | At duck.com | At duck.com |
The provider must be connected on this account. As with making aliases, the web vault can’t reach Firefox Relay. An alias that a provider gave no id for can only be changed on the provider’s site. Providers may treat deletion differently: some keep a deleted address reserved so nobody else can claim it.
Errors
Section titled “Errors”| You see | What to do |
|---|---|
| The provider turned down the API token | The token was revoked, mistyped or lacks a scope. Make a new one and connect again. |
| Too many aliases in a short time | Your provider’s rate limit. Wait a few minutes. |
| Your browser blocks this provider on web pages | Use the extension or the apps for Firefox Relay and DuckDuckGo. |
| Couldn’t reach the provider | Check your connection; a self-hosted server must allow calls from this page. |
An Octa Pass alias service
Section titled “An Octa Pass alias service”Octa Pass has its own mail forwarder, the relay. It’s built and tested, and it’s off by default. The hosted Octa Pass service doesn’t run it, and it hasn’t been used with real mail yet: running it for the public needs a domain, a mail provider and an abuse process that haven’t been decided. Self-hosters can turn it on for their own server.
On a server with the relay, each alias forwards to your account’s email, and you can reply through it. Messages pass through without being stored, but email isn’t end-to-end encrypted: they’re readable by the relay while they’re forwarded. Your vault isn’t affected. See what the relay stores.
What Octa Pass won’t do
Section titled “What Octa Pass won’t do”Octa Pass doesn’t read your inbox or SMS, and it won’t offer masked phone numbers. Verification codes sent by SMS are filled by iOS and Android themselves. Masked email isn’t available in a local vault, because it needs an account.