Do I really need a different email for every website?

No, but the more separation you have, the easier it is to trace a leak and cut off spam. Start with the accounts that matter: banking, shopping, and anything holding payment details. For low-stakes signups, a disposable inbox is enough.

What is the easiest way to manage many aliases without a spreadsheet?

Use a password manager that generates and stores an alias when you save a login. The alias lives in the same entry as the password, so you find it by searching for the site. Alternatively, a catch-all domain with a simple naming rule lets you reconstruct the address from the site name.

Can I use a disposable email address for every signup?

You can for one-off signups, but not for accounts you need to keep. Disposable inboxes expire, so codes sent later, password resets, and receipts will be lost. Use them for downloads, trials, and forums you may not revisit.

Will using an alias stop spam completely?

No. It stops spam from spreading across your accounts and makes the source easier to identify. If an alias starts receiving spam, you can disable it and the mail stops. But a site that has your real address can still send you spam directly.

Is it against the rules to use an alias on a website?

Usually not. Many sites accept aliases. Some block disposable domains, and a few require a specific type of address. Do not use an alias to evade a ban, a fraud check, or identity verification. Check the site's terms if you are unsure.

One Email Address Per Website: Why It Works and How to Do It Without a Spreadsheet

Using one email address per website works because it turns your inbox into a record of where you signed up. If an address starts receiving spam, you know exactly which site leaked or sold it, and you can cut that address off without touching the rest. You do it without a spreadsheet by letting a password manager generate and store the alias for you, or by using a catch-all domain and a simple naming rule. This guide explains the strategy, the tooling, and where it breaks.

Why does a unique address per site beat a single inbox?

Your email address is the key that ties your activity across the web. When you reuse the same address everywhere, a breach at one site exposes the key to every other site. A unique address per site contains the damage. It also gives you something a single inbox cannot: attribution. When a message arrives at shop-xyz@yourdomain.com, you know which company passed it on, whether through a breach, a partner list, or a careless newsletter tool.

This is not about hiding from every website. It is about making each relationship separate. If you need to close one, you close one. The rest of your email life carries on.

The practice overlaps with disposable email, but it is not the same thing. A disposable inbox is temporary by design. A per-site alias is usually long-lived. For a comparison of the two approaches, see Email Aliases vs Disposable Email: Which One Do You Need?.

What you gain: leak attribution and instant cut-off

The two practical benefits are worth spelling out because they change how you handle spam.

Leak attribution. If an address that you gave only to one retailer starts receiving messages from a different company, you have evidence of sharing. You do not need to guess. The address itself is the evidence.
Instant cut-off. When an address becomes a spam magnet, you disable it. Any mail sent to it stops arriving. You do not have to unsubscribe from lists you never joined, and you do not have to filter around a site that ignores unsubscribe requests.
Cleaner recovery. If one address is compromised in a breach, you change the password on that account and move on. Your other accounts are not tied to the same login identifier.
Better records. Your inbox shows which services you actually use. Addresses that go quiet for a year are a prompt to close the account.

None of this requires a spreadsheet. It requires a system that creates the address and remembers it for you.

How do you generate and track aliases without a spreadsheet?

The spreadsheet problem is real. A list of addresses in a file becomes stale, gets lost, and is itself a privacy risk if it falls into the wrong hands. The better approach is to let a tool that already stores your logins store the alias too.

Use a password manager that generates aliases

Several password managers can create a unique email address when you save a new login. The alias is stored in the same entry as the username, password, and website. You never type it into a separate list. When you need to find it, you search for the site, not the address.

The exact features vary by product and plan, and they change. Check your password manager's current documentation before relying on a specific integration. The general pattern is the same: the alias is created at the point of signup and saved automatically.

Use a catch-all domain with a naming rule

If you own a domain, you can configure a catch-all so that any address at that domain reaches one inbox. Then you invent a rule: the site name plus a short suffix. newsletter@, shop@, bank@. The rule is the index. You do not need to write it down because you can reconstruct it from the site name.

A catch-all has a downside: it accepts mail for any address, including addresses you never created. Spammers guess common names. You will see junk arrive at addresses that were never used for a signup. That is noise, not a leak. For a fuller treatment, read What Is a Catch-All Email Address and Should You Use One?.

Use a temporary inbox for one-off signups

Not every signup deserves a permanent alias. For a download, a forum you may never revisit, or a free trial that requires an email, a disposable inbox is the right tool. It expires, and that is the point. The strategy is to match the lifetime of the address to the lifetime of the relationship. A 60-minute inbox for a one-off download. A permanent alias for a service you will use for years. If you are new to disposable inboxes, start with What Is a Disposable Email? A Plain-English Guide.

What breaks, and when should you use a real address?

Per-site aliases are not a universal replacement for your main address. Some things break, and some situations call for a real or well-established address.

Codes sent later. If you sign up with a temporary inbox and the service sends a verification code days later, the inbox may be gone. Alias services that forward to your real inbox do not have this problem. Disposable inboxes do.
Recovery. If you lose access to the alias, you may lose the account. A password manager helps, but a catch-all domain depends on you keeping the domain registered.
Two-factor authentication. Some services tie 2FA to the email address. Changing the address can lock you out. Set up 2FA before you need it, and keep backup codes somewhere safe.
Purchases and receipts. If you buy something, you need an address that will still exist when the receipt, warranty, or delivery update arrives. A disposable inbox is the wrong choice for a purchase.
Bans and fraud checks. Sites that block disposable addresses are doing so deliberately. Do not use aliases to evade a ban, a fraud check, or an identity verification requirement. That is not a privacy strategy; it is a terms-of-service problem.

The honest rule: use an alias where you want separation, and a real address where you need continuity. For a decision framework, see Temp Mail vs VPN vs Email Alias: Which Privacy Tool Do You Need?.

How do you start today, step by step?

Decide on your tool. A password manager with alias generation is the lowest-effort option. A catch-all domain gives you the most control but requires maintenance.
Pick a naming rule if you are using a catch-all. Keep it simple enough to remember without notes.
Change your most important accounts first: banking, government, and anything that holds payment details. Use a unique alias for each.
For new signups, create the alias at the point of signup and save it with the login. Do not reuse an alias across sites.
For one-off signups, use a disposable inbox and let it expire. Do not use it for anything you need to recover.
Review once a year. Disable aliases for services you no longer use.

This is a habit, not a project. Once the tool is in place, the work is a few seconds per signup.

Common mistakes to avoid

Reusing one alias for several sites. That defeats the attribution benefit. If two sites share an alias, a leak from either one is ambiguous.
Using a disposable inbox for account recovery. If you cannot receive the recovery email, you cannot recover the account. This is the most common way people lose access.
Forgetting to update the alias after a breach. If an alias is exposed, change it on the site and disable the old one. A breach notice is a prompt to act, not just to read.
Assuming an alias hides your identity. It does not. It separates your accounts. The site still knows who you are if you give it your name, address, or payment details. For what an alias can and cannot do, read Is Temp Mail Safe? What a Disposable Address Can and Cannot Protect.

Sources

NIST Special Publication 800-63B: Digital Identity Guidelines — authentication and recovery guidance, including the risks of email-based recovery.
RFC 2045: Multipurpose Internet Mail Extensions (MIME) Part One — how message bodies and headers are formatted, useful when you inspect the raw source of a suspicious message.

In short

One email address per website is a simple, durable privacy habit. It gives you leak attribution and instant cut-off, and it keeps your inbox tidy. You do not need a spreadsheet: let a password manager generate and store the alias, or use a catch-all domain with a naming rule. Use a disposable inbox for one-off signups, and a real address where you need recovery, receipts, or continuity. Never use aliases to evade bans or verification. Start with your most important accounts and build the habit from there.