Brave, the privacy-focused web browser, has introduced a new feature called Email Aliases in its latest version, 1.94, designed to enhance user privacy by providing disposable email addresses. This functionality allows users to generate unique, temporary email addresses when registering for online services, thereby concealing their actual email address from websites.
The Email Aliases system works by forwarding messages from the service to the user's primary email address, without revealing the primary address to the third-party website. This addresses a privacy gap where, despite Brave's existing data isolation measures that prevent identity inference via cookies or cache, email addresses could still be stored on website servers. By blocking cross-site identity matching, the feature aims to reduce spam and mitigate risks from data breaches, such as phishing attacks or the widespread circulation of personal information to data brokers.
To utilize the email alias generation, users must create a free Brave Account and register their primary email address with it. Brave has stated that its accounts leverage OPAQUE, a password-authenticated key exchange standardized as RFC 9807, for user authentication. This method prevents the transmission of user passwords or their hashes to Brave's servers, thereby reducing exposure to password logging, memory-scraping attacks, and bulk cracking of leaked password databases. However, Brave notes that this particular security measure does not protect against phishing or weak passwords.
The new alias system is offered free of charge for up to five email aliases. Brave has indicated plans to introduce a paid Premium version in the future, which will remove this limitation.
To maintain user privacy during the message forwarding process, Brave stores both the primary address and the generated aliases in an encrypted state. Forwarded messages themselves are not inspected beyond automated spam and malware filtering and are deleted from Brave's servers within seconds of delivery. Any notes associated with the aliases remain local to the user's device or are end-to-end encrypted if synced via Brave Sync.
Brave has advised users testing the new feature that forwarded messages might initially be routed to spam folders as the company works to establish its reputation as an email provider.
