Brave Rolls Out Email Aliases to Cut Off a Common Path to Phishing

Key points

• Brave browser version 1.94 introduces Email Aliases, letting users generate disposable addresses that forward to their real inbox.
• The feature is free for up to five aliases; Brave says a paid Premium tier will lift the cap later.
• Aliases require a free Brave Account, which authenticates users using OPAQUE, a password protocol standardised as RFC 9807.
• Brave stores the primary address and aliases encrypted, and deletes forwarded messages from its servers within seconds of delivery.
• The feature won't stop phishing on its own and won't shield users who reuse weak passwords.

Brave has added a built-in email alias system to its browser, giving users a way to sign up for websites without handing over their real inbox. The feature ships in Brave 1.94 and is aimed squarely at the phishing and spam that follow website data breaches. We covered Brave's browser security problems back on 5 August, when researchers found every major AI-powered browser could be manipulated by hidden instructions on a webpage; this move addresses a different but equally persistent gap.

When you register for a new service, Brave generates a random address. Mail sent to that address forwards to your real one. If the site is later hacked, or sells your details to a data broker (a company that buys and resells personal information), the address that leaks is the throwaway.

What exactly did Brave ship?

Brave 1.94 adds Email Aliases tied to a free Brave Account. Users register their real address once; the browser creates aliases on demand, up to five on the free tier, with a paid Premium option promised later.

Brave already isolates cookies and cached files so websites can't link a user across sites. Email addresses were the missing piece. An address entered into a signup form sits on that company's servers indefinitely, and often ends up in breach dumps circulating for years.

How does the login side work?

Brave Accounts authenticate using OPAQUE, a password-authenticated key exchange standardised as RFC 9807. Your password is never sent to Brave, and Brave never stores a hash of it either. If Brave's own servers are ever breached, there's no password database for attackers to crack in bulk.

Brave is candid about the limits. OPAQUE doesn't stop someone typing their password into a fake Brave login page, and it doesn't rescue anyone using a weak password.

What happens to the forwarded mail?

The primary address and every alias are held encrypted on Brave's servers. Forwarded messages pass through automated spam and malware filtering, then get deleted from Brave's systems within seconds of delivery. Notes users attach to an alias stay on the local device, or, if Brave Sync is on, are end-to-end encrypted between devices.

One practical caveat: Brave warns that forwarded mail may land in spam folders at first while its sending domain builds a reputation with the big mail providers.

Feature at a glance

Should ordinary users care?

Yes, if you sign up for a lot of websites. Every breach headline from the past year almost certainly included email addresses, and those addresses fuel targeted phishing: criminals sending fake emails designed to trick you into surrendering passwords or card details.

Aliases won't fix bad passwords or stop a convincing scam email. What they do is contain the damage of any single breach. Burn the alias, keep the inbox. That's a modest but real improvement on the status quo, and it costs nothing to try.

Common questions

Do I need a Brave Premium subscription to use aliases?

No. The Email Aliases feature uses a free Brave Account, separate from Brave Premium. The free tier covers up to five aliases.

Will this stop phishing entirely?

No. Aliases reduce the volume of phishing that reaches you after a breach, but they don't detect scam messages. Brave explicitly says the system doesn't protect against phishing or weak passwords.