Signing up for a VPN with a protected email address means using a dedicated alias as the signup address instead of the main inbox address. Verification links, password resets, renewal notices and support mail go to the alias, while the main address never enters the provider's records. Most commercial VPNs ask for an email address at signup, and that address remains tied to the account for the whole subscription. Because a VPN subscription is paid and runs for years, the signup address has to keep working for years. One alias per VPN meets that need: it handles verification, billing and recovery, and the account stays recoverable while the alias stays active.
What the signup email is used for#
At most commercial VPN providers the signup email serves as the account identifier and as the route for verification, password reset, billing and support mail. NordVPN says one email address and one password cover its services, and a new subscriber gets a registration link at the address used at signup. ExpressVPN says in its privacy policy, last updated 2 October 2026, that an email address and payment information are required to provide the service.
The same policy lists the uses of the address: password reset or verification emails, order confirmations, renewal notifications, price increase notices, updates, account communications and marketing mail. Data from transactional communications is retained for ten years. The address is therefore used whenever money is taken, whenever the price changes and whenever access has to be restored, not only at signup.
Signup requirements at the main providers#
| Provider | Email address required at signup | Notes |
|---|---|---|
| NordVPN | Yes | One email address and one password cover NordVPN, NordPass and NordLocker |
| ExpressVPN | Yes | Email address and payment information are required to provide the service |
| Surfshark | Yes | An email address, or a Google or Apple account link |
| Proton VPN | Yes | The account email is the identifier for the whole Proton account |
| Mullvad | No | Comparitech reports a randomly generated 16-digit account number replaces the email address |
NordVPN runs its services through one Nord Account. A single email address and password sign the user in to NordVPN, NordPass and NordLocker, and subscriptions and auto-renewal are managed from the account page. Website buyers choose a plan, enter their details, pay, and then get a Nord Account registration link at the signup email address. The link must be clicked and a password created before the account is ready.
Buying from a retailer takes a different route that still depends on email. NordVPN says a purchase from Amazon, Best Buy or Target includes a 25-character activation key, and the activation page asks for the key and an email address. A verification code goes to that address and must be entered before setup completes, and the address entered at that step becomes the account address.
ExpressVPN states in its privacy policy that personal data may include the name, email address and payment information submitted when the account is created or updated. The email address is still required in the ordinary signup, even when the payment method is chosen to limit other data.
Surfshark asks for an email address to create an account, or a link to a Google or Apple account. Signing in with credentials means entering the email address and password in the app. The account's subscription page shows the current plan, the expiration date and the renewal date, and Surfshark says auto-renewal can be cancelled there. Surfshark says a confirmation email may arrive after cancellation, and the subscription remains active until the expiration date.
Proton VPN sits inside the Proton set of services, and one Proton account covers Proton VPN, Proton Mail, Proton Drive, Proton Calendar and Proton Pass. The account email identifies that whole set, so the address given at VPN signup is also tied to the rest of the Proton account.
Mullvad and the no-email exception#
Mullvad is the exception among the providers checked. Mullvad charges 5 euros per month and describes its accounts as anonymous, with no logging. Comparitech says Mullvad gives each user a randomly generated account number instead of an email address for account access, and the number is the only credential, so losing it loses the account because there is no recovery. The same comparison says Proton VPN signup asks for an email address and a secure password, the ordinary pattern for most VPNs.
Mullvad's model removes the signup email problem by removing the signup email, and it removes email recovery with it. A user who loses the account number has no email address on file for a reset link. An email address at signup gives the provider a way to restore access and a lasting identifier, while an account with no email address on file has no email route for recovery.
Renewal and recovery#
A VPN subscription renews on a schedule, and the provider sends renewal and price increase notices to the signup address. Surfshark shows the renewal date on the subscription page, and auto-renewal is cancelled from the same page. A subscriber who cannot read the signup inbox misses the renewal notice, the new price and the renewal date, and cannot act on them in time.
Recovery is the other place the signup address matters. Proton VPN says a user locked out with no password needs a recovery method set in advance. A signed-in password reset takes a 72-hour wait, and recovery by email sends a code to a verified recovery email address that had to be set and verified before the lockout. A signup address that has stopped working cannot receive that code, so the recovery path is closed.
Surfshark two-factor authentication by email sends a six-digit verification code to the inbox, and the code must be entered to confirm the setup. The account email is therefore used for login security as well as billing.
The breach record#
TechRadar reports, from NordVPN's own account, that one server in Finland was affected, the attack ran between 31 January 2018 and 5 March 2018, NordVPN said it learned of the breach on 13 April 2019, and it audited its 5,000 servers. NordVPN said the intruder had no access to user credentials, billing details or other profile information, and the TLS keys obtained in the attack expired in October 2018.
A signup email address is stored with the provider for years, and it links the VPN account to the person who holds it. Have I Been Pwned listed 1,049 pwned websites and 17,847,746,941 pwned addresses on 7 November 2026. An address that appears in one breach can be matched against other breaches, and one address used for many accounts links those accounts together. A dedicated alias for the VPN breaks that link at signup, because the provider is given an address used for that provider only.
The dedicated alias method#
The method is one alias per provider, created before signup and entered as the signup email address, kept active for the life of the subscription while provider mail is checked to still reach the main inbox through it, with a different alias for each other service so the VPN alias receives mail from the VPN provider only.
The provider stores the alias, so verification links, password resets, renewal notices and support replies go to it and forward to the main inbox. The main address is never typed into the VPN signup form, so the provider's account records never hold it. The alias must keep working for years. It is not closed, paused or allowed to lapse while the subscription is active, or recovery and renewal mail stops arriving.
A VPN subscription is paid and long-lived, so the signup address must stay active for the whole subscription. An address that stops working leaves the account unrecoverable by email and the subscription unmanageable, since a short-lived inbox does not last for the life of a paid account.
The same setup includes a password manager and two-factor authentication. Each VPN account gets a password used nowhere else, and two-factor authentication is switched on wherever the provider offers it. Surfshark offers two-factor authentication by authentication app or by email, and the app option does not depend on the inbox. The alias still matters even then, because the password reset still goes to the signup address.
AliasFleet aliases#
AliasFleet supplies email aliases that forward to a verified destination inbox. Every service gets its own address, and an alias that starts receiving spam can be disabled in one click. The Free plan includes 10 active aliases and 1 verified destination inbox. A VPN alias fits that model: it is created once, kept for the life of the subscription and used for that provider only. The guide to using email aliases covers the same one-alias-per-service pattern across twelve practical examples. AliasFleet does not make the VPN account anonymous, since the provider still holds the alias address, the payment details and the subscription record.
Keeping the alias alive#
If the destination inbox changes, the alias forwarding must point at the new inbox, or renewal and recovery mail goes to an address that is no longer read.
When the VPN provider is changed, the old alias stays active until the old subscription has ended and any refund or final bill has arrived, and only then is it closed.
