An email address alone does not open the mailbox behind it. Reading the mail in a mailbox requires a password, a passkey, an active signed-in session, or access at the provider, and an address supplies none of those. An address is a public identifier, not a credential: it names the account, while the password proves who is asking to open it. The address and the mailbox are separate things, and knowing the first does not open the second.
This article describes the authentication a mailbox requires, the actions an address alone makes possible, the routes that do lead to mail being read, and the controls that block those routes. The statements below come from Google and Microsoft documentation and from Have I Been Pwned.
Mailbox authentication#
A mailbox opens by one of four routes, and an address on its own is none of them. The first route is a password or a passkey. The second is an active session in a signed-in browser or app that has already passed the check. The third is a recovery process that proves ownership through a channel already on the account. The fourth is access at the provider itself, covered in the piece on whether an email provider can read mail.
Google's sign-in help for Gmail states the steps: the Google Account email or phone number and the password are entered, and then the inbox opens. The address identifies which account to open, and the password proves who is asking; without the password, the sign-in page displays no mail.
Uses of an address alone#
An address alone still allows several things, and none of them reads mail. Someone who knows an address can send mail to it, check whether it appears in known breach data, test the address on service sign-in pages to see whether an account exists there, send phishing messages that use the address and the name attached to it, and start a password reset, which sends a code or a link to the recovery channel on the account. Whether a given sign-in page confirms an account varies by provider and by sign-in flow.
Sending mail puts a message in the inbox and does not display the messages already there. Checking a breach database shows where the address has appeared, not what is in the mailbox. A password reset sends a code to a channel the attacker does not control, and the reset stops there unless the attacker can also read that channel. Spam is the most common result; how spammers get email addresses covers that subject. Phishing is the more serious result, because a phishing message can lead to the password being given away. The address makes the message possible, and the password is what opens the mailbox.
Breach data#
The service's own FAQ states that when breach addresses are loaded into the service, no corresponding passwords are loaded with them, and that 90 breaches are classed as sensitive and can only be searched by the verified owner of the address. Have I Been Pwned holds 1,049 pwned websites and 17,847,746,941 pwned addresses in its index, as checked on 5 November 2026. An address used for years is likely to appear in at least one breach, and the risk depends on what leaked with it.
Have I Been Pwned states that an email address on its own is "not enough to gain access to someone's online accounts".
A breach entry lists which kinds of data were exposed. An entry listing only the address points to more spam and more convincing phishing; an entry listing a password calls for changing it everywhere reused, starting with the mailbox.
Password reset process#
Microsoft's password reset help states that Microsoft must verify identity before a reset, by sending a verification code to a recovery email or phone number already on the account, and the code is needed before a new password can be set. Microsoft also states that its support agents may not send password reset links or access and change account details.
Google's account recovery help states that recovery asks questions to confirm ownership, and that a password reset is offered after those questions are answered. Changes to recovery information may take up to 7 days to take effect. Google also states that nobody can call Google for help signing in to an account, and that passwords and verification codes should not be given out. The reset code goes to a channel the account owner set up, which an attacker who knows only the address does not have, so the reset cannot be completed. An unrequested code is a sign that someone tried, and it is useless to the attacker unless the inbox or phone it was sent to can also be read.
Phishing and password capture#
Google's phishing help defines phishing as an attempt to steal personal information or break in to online accounts using deceptive emails, messages, ads, or sites that look similar to sites that the target already uses. A phishing message at a known address looks more convincing because it uses the real address and sometimes the real name, and a fake sign-in page then asks for the password. The route works by capturing the password, not by using the address: the address made the message possible, and the password is what opens the mailbox.
A password entered only on the genuine sign-in page, after the address bar has been checked, breaks this route; a password entered after following a link in a message does not. A password entered on a fake page opens the mailbox in the same way as the real one. The takeover methods piece, can someone hack my email without my password, treats phishing as a central method. Without the password, it fails.
SIM swap and phone numbers#
A SIM swap is the one documented route that reached an account without a password, and it worked through a phone number rather than an email address. In September 2019, attackers took control of the phone number attached to the Twitter account of Jack Dorsey, the company's chief executive, by tricking his mobile provider into handing the number over. They then posted messages from his account by text message, without logging in. SecurityWeek's report records that Twitter stated its own systems were not compromised, and quoted the company: "The phone number associated with the account was compromised due to a security oversight by the mobile provider."
The attackers did not read Dorsey's mail, and they did not use his email address to get in. They took control of a phone number and used a text-to-post feature that accepted messages from that number. A phone number on an account functions as a second key: SMS codes sent to a controlled number go to the attacker, so a SIM swap can complete a password reset that uses SMS codes. An address alone does not allow this, and a phone number has to be taken over as well.
Two-step verification#
Google's setup page for 2-Step Verification states that a new phone number added for the second step may take up to 7 days for Google to trust. Google prompts can help protect against SIM swap and other phone number-based hacks, because a prompt is a push notification to a signed-in device, not a text message to a number.
Google's page on protecting personal information with 2-Step Verification states that signing in with a password and a second step protects against password-stealing scams, and that even if someone gets the password online, they will not also have the phone. It does not make the address secret, and it does not stop phishing messages from arriving. It stops a stolen password from being enough on its own.
Per-site aliases#
When each site gets its own address, the address that leaks from one site is a forwarding address for that site only, and it is not the address that signs in to the mailbox. A stranger who knows the alias for a shopping site knows an address that receives mail from that site, not the mailbox address, and the alias is not an account, so it cannot be used to sign in anywhere. Per-site aliases therefore change what an address exposes, because they change which address a stranger holds.
The effect is containment. If an alias starts receiving phishing messages, it can be paused or closed, and the mailbox and every other alias keep working. The address that the attacker holds becomes useless, because it was only ever connected to one site.
Signs of mailbox access#
A reset code that arrives without a request is a sign of an attempt, not of access. Access looks different: mail marked as read that was not read, sent mail that was not sent, forwarding rules or filters that were not created by the owner, a changed recovery address, or sign-in alerts from unfamiliar devices.
Someone using an email address covers the signs that an address is being used elsewhere, a different problem from mailbox access that needs a different response. Whether someone can send emails from an email address covers the neighbouring question of what an address can be used for once it is known.
AliasFleet address handling#
AliasFleet provides per-site forwarding addresses. Each site receives its own address, mail sent to that address forwards to the mailbox address, and the mailbox address is not shared with the site. An alias that starts receiving phishing messages can be paused or closed without affecting the mailbox or the other aliases. AliasFleet does not make the mailbox address secret from a provider, and it does not replace a password or two-step verification: a password entered on a fake sign-in page still opens the mailbox.
The address and the mailbox#
An email address is a public identifier. It is typed into forms, stored in company databases, and copied into breach lists that hold billions of records. A mailbox is a private store that opens with a password, a passkey, a session, or a verified recovery, and none of those things is contained in the address.
Knowing the address lets a stranger send mail, check breach lists, try a reset, and write a convincing phishing message. It does not let them read the mail: the routes that do need a password, a session, a phone number, or a device. Protecting mail is therefore a matter of the password, the second step, and the recovery details, not of keeping the address itself a secret.
