Two tools, two different jobs
An account usually begins with two pieces of information: an identifier and a secret. The identifier is often your email address. The secret is your password.
A password manager helps you create and keep a different secret for every account. An email alias gives every account a different identifier. One strengthens the lock; the other stops you putting the same nameplate on every door.
Unique password. Unique address. One breach has less to borrow.
What a password manager solves
People are bad at remembering dozens of long, random passwords, so we shorten them, reuse them or change a digit. A password manager removes that bargain. It can generate a strong password for each service, store it securely and fill it on the right site.
If a shop leaks its password database, the password for your bank is still different. That containment is the central benefit. Multi-factor authentication and passkeys can add further protection.
But the manager does not hide the email address used to create the account. That address can still be leaked, sold, correlated across services or targeted with convincing phishing.
What a separate alias adds
A different address for each relationship reduces the value of the identifier that leaks. If a retailer loses shop-name@…, an attacker has not automatically learned the address used for your bank, cloud storage or family correspondence.
It also creates context. A supposed bank warning sent to an address used only for clothes shopping is immediately suspicious. And if that shopping address becomes a permanent spam target, you can replace or retire it without moving every other account.
A small breach, two outcomes
Imagine a retailer exposes customer email addresses and passwords. Your password manager has already protected the other locks because they use different passwords. Your alias has protected the other nameplates because they use different addresses.
The breached account still needs attention, but the incident has fewer places to travel. That is what good security layers do: they turn one large problem into one contained problem.
A practical layered setup
- Create a durable alias for the service and label it clearly.
- Let your password manager generate and store a unique password—or use a passkey when available.
- Turn on multi-factor authentication for valuable accounts.
- Store recovery codes somewhere safe, separate from the account itself.
- If the service is breached, change the password and decide whether the alias should also be replaced.
Neither tool makes every message trustworthy. Check the site before entering credentials, be wary of urgent requests and never approve a login you did not begin.
Do not make recovery disposable
A temporary address is fine for a one-off download. It is a poor recovery address for banking, taxes, a domain registrar or anything you may need years from now. Important accounts need a durable alias that you control and can keep.
The useful rule is simple: make the public identifier different, but make the recovery path dependable.
Give every new account its own nameplate.
Create an MXDuck alias