Hide My Email is Apple's relay service: it hands you a random address ending in @privaterelay.appleid.com that forwards to your real mailbox, so the site or app you signed up with never learns your actual address. It exists in two forms. One is free and built into Sign in with Apple, which creates a single address per app at the moment you log in. The other is part of the paid iCloud+ tiers and lets you generate an address for any form you like, label it, and switch it off later. Both do their job well. Both also funnel everything through one Apple Account, and that single fact is what decides whether Hide My Email is the right tool for a particular signup or the wrong one.
Here is what each version actually does, what happens when you reply, the reason some relay mail never turns up at all, and the situations where a different kind of address is the better answer.
Two versions of the same idea
The free version appears inside the Sign in with Apple consent sheet. When an app offers Apple as a login option, the sheet asks whether to share your email or hide it; choosing to hide it mints a relay address scoped to that one app. You do not get to pick the address, you cannot reuse it anywhere else, and it exists because of the login relationship rather than independently of it.
The iCloud+ version is a general-purpose address generator. You reach it from Settings under your name, in iCloud, or on iCloud.com, and Safari will also offer to create one inline when a web form asks for an email. Each address can carry a label so you remember what you made it for, and the destination it forwards to is any address already verified on your Apple Account — it does not have to be an Apple one.
What the address is, mechanically
It helps to be precise about this, because it explains most of the limits further down. A relay address is not a mailbox. There is nothing to log into, no message store, no separate password. It is a forwarding rule: mail arrives at Apple, Apple rewrites it and sends it on to the destination you nominated, and the message lands in the ordinary inbox you already read. Everything a site sends you still reaches you. What you have gained is a handle you can label, trace and eventually switch off, not a reduction in mail.
Replies work, and that is the real advantage
When you answer a message that came in through a relay address using Apple's Mail app, the reply goes back out through the relay. The recipient sees the privaterelay.appleid.com address they already had, not the mailbox behind it. The conversation can continue indefinitely without the other side ever holding your real address.
That is the clearest advantage over the labelling trick most people try first. With a tagged address of the name+shop@gmail.com kind, your real address is sitting inside the tagged one, and the moment you reply, your mail client sends from the untagged form anyway — we went through the five ways that falls over in how plus addressing works and where it fails. A relay address has no such leak: there is no real address embedded in it to extract, and the reply path keeps the substitution intact. If you want a disguise rather than a label, that difference is the whole point.
Switching one off, and the catch with login addresses
Deactivating a relay address stops it forwarding. Mail sent to it afterwards no longer reaches you, which is exactly what you want when a shop you bought from once starts selling your address on.
The catch applies to the Sign in with Apple version, where the relay address is not merely a contact route but the identifier the app knows you by. Turn off forwarding and you may well still be able to log in with Apple, but the company has lost its only channel to you — which also means password resets, receipts, security notices and account-closure confirmations all go nowhere. Worse, if you revoke the app's use of your Apple Account entirely, you have removed the thing your account was keyed to. Before you cut a login address loose, check whether you can add a second contact address inside the service itself.
Why some relay mail never arrives
This one is worth knowing because it looks like your fault and is not. Apple requires any app using Sign in with Apple to register the domains and addresses it sends mail from. If a developer never completes that step, or starts sending from a new domain they forgot to add, the relay refuses the message and it never reaches your inbox.
So when a confirmation to a relay address simply does not turn up, the usual cause is the sender's configuration, and there is nothing you can adjust from your side to fix it. The practical response is to use a different address for that service rather than waiting. It is a good argument against using a relay address for the one signup you urgently need to work.
Where Hide My Email is the right choice
The feature is built around permanence, so it pays off wherever you expect a relationship to last. Shops you buy from repeatedly, subscriptions, utilities, anything that will send you a receipt in two years' time: giving each of those its own relay address means you can identify a leaker precisely and retire it without touching anything else. The labels make that practical at scale, which a pile of random addresses in a notes file never is.
It is also the easy answer if you are already paying for iCloud+ and living on Apple devices, because the cost is sunk and the generator is one tap away inside the form you are already filling in. Convenience at the point of signup is most of what determines whether people actually use a privacy tool more than twice.
Where something else fits better
You are not inside Apple's world
Creating and managing relay addresses assumes an Apple Account, and in practice an Apple device or at least a browser session on iCloud.com. On a work laptop, a shared machine, Android or Windows, the friction is high enough that you will skip it. Cross-platform alias services and plain temporary inboxes do not care what you are holding.
The form rejects the domain
Relay addresses are accepted far more widely than disposable-mail domains, because they are permanent and Apple-backed, but some services still refuse them — and when a site has decided a domain is unwelcome, no amount of being right about it helps. The reasoning sites use, and what actually happens on their side, is in why websites block disposable email addresses.
You want nothing forwarded at all
This is the structural difference people miss. Hide My Email hides your address; it does not spare your mailbox. Every newsletter, every promotional sequence, every re-engagement campaign still arrives, just under a different name. For a one-off — a gated download, a forum post you will make once, a trial of a tool you will almost certainly abandon — you do not want a durable channel into your inbox at all. A temporary inbox takes the confirmation code and then stops existing, so there is no address to retire later and nothing forwarded anywhere.
Everything hangs off one account
Each relay address is independent from the site's point of view and completely dependent from yours. One Apple Account holds the mapping for all of them, which means losing access to that account, or having it locked, takes every address with it. If separating your accounts was the point, concentrating the keys in a single place deserves some thought first. The trade-offs between relays, self-hosted aliases and disposable inboxes are laid out in our comparison of aliases and disposable addresses.
You need to read the mail with code
Relay addresses forward into a human mailbox and expose no API. For testing signup flows, or for anything that needs to fetch a verification link automatically, a relay is the wrong shape entirely.
Deciding in one line
Ask whether you want the relationship to continue. If you do, and you only want control over the address it runs on, a relay address is a good answer and Hide My Email is a well-made version of it. If you want the relationship to end when you close the tab, do not create a permanent forwarder to walk away from — use something that expires on its own.