Email leak tracing · Start with your next sign-up

Give every unfamiliar email
a destination you can check..

To find out where an email address may have leaked, use a different recipient address for each site. Record each site and alias, then when an unfamiliar email arrives, check which address it came through.

Add an existing alias

An address for each siteUse a different alias for every site

Check where it was sentCheck the recipient alias, not just the sender

Isolate emails individuallyConfirm what depends on it before disabling the alias

This is a lead to investigate, not proof of a data leak. You can’t separate the sources after sharing one email address with dozens of sites. Even if a dedicated alias receives marketing emails, that alone doesn’t prove the site sold your data. Check separately for marketing consent, service providers and other possible leak paths.

01 / Log a site

Keep a record for each address.

First, create an address in Manage aliases, then enter the full address here. This table only records which site it belongs to. It doesn’t create aliases or check whether an address is active.

Saved in this browser only

Site and alias records

0 records

No records yet

Save a record for an alias you already have. The three examples below are for reference only and won’t be added to your records.

Records are stored in this browser’s local storage. This tool doesn’t send them to the Swiftfwd backend or sync them with your account. They may be lost if you clear site data, use another browser or close a private browsing window. Don’t save records on a shared device. Removing a record won’t delete or disable the actual alias.

JavaScript is required to save and match local records. You can also keep site-to-alias records in your own spreadsheet and check incoming mail in Manage aliases. The guidance on this page is still available without JavaScript.

02 / Check incoming mail

Check who it was sent to,
then see who sent it.

Find the recipient alias actually used in the email details or original headers, then enter the full address on the right. The tool checks for an exact match in your local records. It doesn’t read your inbox or verify whether an email is genuine.

Only seeing your real email address?

After forwarding, the “To” field may show your real email address. Go to the 30-day archive in the dashboard to check the associated alias, or see whether the original recipient details were retained in the email headers. Fields such as To and Delivered-To can help, but they aren’t guaranteed to provide reliable records for every email.

Waiting for a check

Find the actual recipient address first

After adding a record, enter the alias used for the email. This tool will show the associated site and suggest next steps, but it won’t identify a leak source with certainty.

03 / Assess the clues

A matching address
doesn’t prove it was sold.

An address record tells you which recipient path an email came through, not who did what. How strong the clue is depends on whether the alias was unique, as well as the email content and your consent settings.

Narrower scope · Still needs checking

A match for a unique alias

If you gave this alias to just one site, a match narrows the search to that site and the related services that handle its mail.

What you can’t confirm yet: A match can’t distinguish a leak at the site from one at a service provider, authorised marketing or a guessed address—and it doesn’t prove the data was sold.
Next steps: Save relevant headers and timestamps, check your marketing consent, and review the alias’s mail in the dashboard archive. Contact the site if needed.

Broader scope · Can’t identify one source

The same alias used on multiple sites

If multiple sites shared an alias, each is only a possible source. A single entry in your records doesn’t mean you only used it once.

What you can’t confirm yet: One match can’t identify a particular site as responsible. Missing records of past use can also affect your assessment.
Next steps: Add any known past uses and use a separate alias for each site going forward. Before replacing an old address, check account recovery and service notifications for each site.

Could be routine · Check the content

A regular message from a business

Order, shipping, billing and service-change emails may be expected. A third-party sending domain that differs from the business name isn’t automatically suspicious.

What you can’t confirm yet: Promotional wording or a sender display name alone can’t tell you how your data was shared. Display names and links in emails can also be spoofed.
Next steps: Check your order and subscriptions through a website you know. Don’t click suspicious links. Unsubscribe or disable the alias only when you’re sure you no longer need it.

Not enough information · Leave it unknown

Unknown source or no match

You may get no match because there are no local records, you can only see your real email address, or the alias was entered differently. No match doesn’t mean the address wasn’t leaked.

What you can’t confirm yet: You can’t work backwards to identify an unknown site or invent a sign-up trail for spam sent to an old email address.
Next steps: Check the original recipient details, automatic forwarding and spelling. Leave the source unknown and start keeping separate records with your next sign-up.

04 / Isolate an alias

Check what depends on it before switching it off.

This page won’t disable an alias for you. Open the dashboard to check the address and archive. Disable it only after confirming you no longer need that recipient path.

Go to Manage aliases

01

Check the alias and archive

Make sure the full alias in the dashboard matches the one in the email. Check the subject, sender and timestamp in the 30-day archive. Your records may be wrong, and the archive isn’t a permanent history.
02

Move notifications you still need

Check for pending orders, account recovery, billing and upcoming service emails. If you still use the site, change your recipient address there first and make sure the new address can receive email.
03

Disable only the alias you’re checking

Disable just this address in the dashboard; your other aliases will keep forwarding. Emails sent to it while it’s disabled will be discarded, not forwarded to your real inbox. Re-enabling it won’t recover those emails.

Disabling isolates an alias; it doesn’t undo what happened. It can’t delete an address a site has already saved, stop emails to other addresses the sender knows, or automatically remove spam already in your real inbox.

05 / Examples for future sign-ups

Use a separate address next time you sign up.

Here are three examples of separate records. These example addresses weren’t created by this page and can’t be used to sign up. Replace them with aliases you’ve actually created in the dashboard.

Shopping site

shopfern83@swiftfwd.com

Date recorded: The day you first submitted the address
Purpose: Orders, shipping and support updates

Good for ongoing forwarding. Orders may generate updates after the first verification code, so don’t decide how long to keep an alias based only on the sign-up date.

Tech forum

forummoss21@swiftfwd.com

Date recorded: The day you first submitted the address
Purpose: Account recovery and reply notifications

If you plan to keep using the account, keep its alias. To reduce notifications, adjust your forum subscriptions first so you don’t accidentally lose account recovery access.

SaaS trial

trialreed56@swiftfwd.com

Date recorded: The day you first submitted the address
Purpose: Trial confirmation and expiry reminders

Use a forwarding address while you’re waiting for trial results, billing or expiry notices. Decide whether to disable it only after the service ends.

Only need one verification code?

If you don’t need long-term account recovery, order updates or service notifications, you can use a temporary email address. It lasts 3 hours by default, can be extended by 3 hours at a time while active, and lasts up to 24 hours. It can only receive email; expired messages can’t be recovered. It’s not suitable for accounts you need to keep.

Use a temporary email

Check summary / Next steps

Keep the clues,
and wait to draw conclusions until you’ve checked.

No address checked yet

First record an existing alias, then check the recipient address actually used by the email. You’ll get the matching records and suggested next steps—not a verdict that a particular site leaked your data.

To isolate incoming mail, check the alias in the dashboard and disable it if appropriate. If you only need a one-time verification code, go back to your temporary inbox.

You can’t trace every source of leaks from an old email address, guarantee that every platform accepts aliases, or stop all spam. Before using the service, read the Privacy policy and Terms of service, or return to the incoming mail check to investigate further.