Fastmail Masked Email vs Apple Hide My Email: Which to Use

Both Fastmail Masked Email and Apple Hide My Email do the same headline thing: they hand you a random address at signup, forward anything sent to it into your real inbox, and let you shut that address off when it starts attracting spam. The Fastmail Masked Email vs Apple Hide My Email decision is not really about that shared feature. It is about four things underneath it — where the alias lives, whether you can reply from it, what happens when you stop paying, and whether you can take the aliases with you.

This is a capability comparison for someone picking one to standardise on across hundreds of signups. Vendor pages change, so verify anything plan-related on the live page before you commit.

The verdict up front#

If you already pay for iCloud+ and your signups happen on an iPhone or a Mac, Hide My Email is the one to use. It is included, it appears inside the Safari form you are already filling in, and there is nothing to set up.

If you are choosing a system to live in for a decade, Masked Email is the stronger choice — but only if you attach it to a custom domain you own. Fastmail's own feature page is direct about why: using your own domain is "a bit less anonymous than using our domain that's shared by many users, but ensures your addresses remain portable." That is the sentence the whole comparison turns on.

The concession, stated plainly: Hide My Email beats Masked Email on friction. Nothing in Fastmail's flow is as fast as tapping a suggested address inside a Safari form, and if convenience is what determines whether you actually use aliases at all, convenience wins.

• Already on iCloud+ and Apple-only — Hide My Email, no argument.
• Want a portable alias estate on a domain you control — Masked Email on your own domain.
• Use 1Password or Bitwarden as the place logins get created — Masked Email, because it plugs into that step.
• Need aliases to survive cancelling a subscription — Masked Email on a custom domain is the only one of the two that can.

Fastmail Masked Email vs Apple Hide My Email at a glance#

Where Fastmail Masked Email wins#

The first win is the custom domain. A masked address can be issued either at fastmail.com or, per Fastmail's documentation, "at a specified custom domain that has been set up in your Fastmail account." On a multi-user account, picking the custom domain requires admin access. That single option changes what an alias is: it stops being a token issued by a vendor and becomes an address at a name you control the DNS for.

The second win is granularity when an address goes bad. Fastmail gives a masked address three states rather than two. Active receives mail normally. Blocked keeps accepting mail but routes it to Trash. Deleted makes messages bounce, and a deleted address can still be restored. That middle state matters more than it sounds: blocking rather than bouncing lets you kill the noise without telling a sender the address is dead, which is what you want when the account behind it still has your order history in it.

The third win is where address creation happens. Fastmail connects to 1Password and Bitwarden, so the alias is generated in the same window where the password is generated and stored. Bitwarden's connection uses an API token. There is also Fastmask, a third-party iOS app for managing masked addresses. If your logins are already born inside a password manager, this removes the step where you have to remember aliases exist.

The limit worth knowing: Fastmail rate-limits creation. Its help page says there are "limits on how many new Masked Email addresses can be created within a certain amount of time to prevent abuse," and advises trying again in 24 hours. You will not notice during normal signups. You will during a bulk re-aliasing of two hundred existing accounts.

Where Apple Hide My Email wins#

Hide My Email wins on the thing that decides whether people actually use aliases: it is where the signup is. Apple lists creation points in Safari when you are filling out a web form, in Mail when composing, in Settings on iPhone and iPad and System Settings on Mac, during Apple Pay checkout, in third-party apps, and on the iCloud+ Features page at iCloud.com. You do not switch apps, and you do not plan ahead.

It also wins on price shape for people already inside the ecosystem. Hide My Email is part of iCloud+, so if you already subscribe for storage, the alias service costs nothing additional. Apple requires iOS 15, iPadOS 15, macOS 12 or later, and two-factor authentication on the Apple Account before you can create an address.

The forwarding target is more flexible than people assume. Mail sent to a random address is forwarded to "your iCloud Mail address or any email address associated with your Apple Account" — so the real inbox behind Hide My Email does not have to be an iCloud mailbox. You can point it at a Gmail or work address you already read.

Finally, Apple's handling of message content is unusually specific for a forwarder. Apple states it "doesn't read or process any of the content in the email messages" apart from spam filtering, and that messages are "deleted from our relay servers after they're delivered to you, usually within seconds." That is a narrower, more checkable claim than most relay services make.

Can you reply from a masked address?#

Yes, on both — and this is the single most common misconception about alias services, because plain forwarders historically only worked one way.

On Apple's side, when you receive mail at a random address you can reply using that same address and your real one stays hidden. In Mail you open the pop-up menu in the From field and choose Hide My Email; if you have never written to that recipient with an alias before, a new address appears there.

On Fastmail's side, you open the sending-address dropdown on the Compose screen and click "Show all" to pick a masked address to send from. So both are two-way relays, not one-way forwarders — which is the practical difference between an alias and a forwarder, and the reason either can be used for an account you will actually need to correspond with.

Where they differ is reach. Apple's reply path lives in Apple's Mail apps and iCloud.com. Fastmail's lives in Fastmail's web and mobile clients. Neither gives you a general-purpose way to send from an alias in an arbitrary third-party client without extra setup, so if you read mail somewhere else entirely, check that before you standardise.

What happens if you stop paying#

This is where the two designs genuinely diverge, and it is worth thinking about before you have four hundred aliases rather than after.

For Hide My Email, the feature is an iCloud+ benefit. Apple's documentation on downgrading is clear that dropping to the free iCloud plan means you no longer have access to iCloud+ features including Hide My Email, and that the change takes effect after the current billing period ends. Your aliases are not portable in any sense — @privaterelay.appleid.com is Apple's domain, and there is no configuration in which it is not.

For Masked Email, the answer depends entirely on the domain you chose. Aliases at fastmail.com are Fastmail's to route, exactly as Apple's are Apple's. Aliases at your own domain are yours: the addresses are records in DNS you control, so moving them to a different provider is a migration rather than a loss.

The smaller version of the same question is what happens to a single address you turn off. Apple deactivation returns mail to the sender and the address can be reactivated at any time; deletion is permanent and syncs across devices. Fastmail's Blocked state drops mail into Trash, and its Deleted state bounces but stays restorable.

Portability, and what it actually means here#

"Portable" in this context does not mean exporting a list of aliases. Both services will show you your addresses. Portable means: if the alias stops being routed by this vendor, does mail sent to it still arrive?

With a vendor-owned domain the answer is structurally no. Nobody but Fastmail can accept mail for fastmail.com, and nobody but Apple can accept mail for privaterelay.appleid.com. With your own domain the answer is yes, because you point the MX records somewhere else and every address keeps working.

That is the argument for accepting the anonymity trade-off Fastmail names on its own page. A shared vendor domain hides which individual you are among its many users; a personal domain does not, because anyone can see that fifty aliases share an owner. You are trading unlinkability for the ability to leave — and most people standardising on an alias service care more about the second than they realise.

Pricing model, without the numbers#

Neither service is sold as a standalone alias product, which is the useful thing to understand about both.

Hide My Email is bundled into iCloud+, a paid storage subscription with several privacy features attached. You are not buying an alias service; you are getting one with something else. There is no free iCloud tier that includes it.

Masked Email is a feature of a Fastmail account, and Fastmail sells mailbox plans rather than alias plans. Fastmail's marketing describes creating a masked address as something every Fastmail user can do in the app, but plan structures change and business plans differ from personal ones. Check the live pricing page for what your plan includes before you commit an alias strategy to it — everything here is a shape rather than a quote, as of September 2026.

Who each one is genuinely for#

The split is cleaner than most head-to-heads, because these two are optimised for different time horizons.

• Apple-only households already on iCloud+ — Hide My Email. The marginal cost is zero and the friction is the lowest of any alias service.
• People who will not maintain a system — Hide My Email. It works without a habit, which is worth more than any feature on this page.
• Password-manager-first users on 1Password or Bitwarden — Masked Email, because it attaches to the step where logins are already created.
• Anyone who owns a domain and expects to change providers — Masked Email on that domain. It is the only configuration here that survives a cancellation.
• Cross-platform users with Windows or Android in the mix — Masked Email, since Apple's creation points are Apple surfaces.

A third option, honestly: the layer neither one is#

We build AI Emaily, an AI email client — not an alias service, and there is no version of this post where we belong in the table above. An alias decides which mail is allowed to reach your address. It has nothing to say about the mail that does reach it, which is most of it, and which is the part that costs you the day.

That is where the adjacent job sits. AI Emaily connects to the real mailbox behind your aliases — Gmail, Outlook, Fastmail, iCloud or plain IMAP — and triages what arrives, drafts replies you approve before anything sends, and keeps an undo window and an audit trail on every action it takes. Voice comes from a Personal Context brain you set and per-client profiles you write, not from anything scraped out of your history, and we do not train on your mail.

The honest limit: we will not generate a masked address for you, and we do not replace either service here. Use Hide My Email or Masked Email for the aliasing; if you want the reading and replying automated, that is the part we do. AI Emaily is a 7-day free trial on Pro and Autopilot, card required, $0 if you cancel before day 7.