Email is quick, convenient, and ubiquitous but unfortunately, the contents of your messages aren’t as private as you might think. In fact, several organizations can read everything you say, including your employer, Internet Service Provider, or even your email service itself. This is a real problem for whistleblowers, human rights activists, or journalists trying to protect their sources. With a little bit of preparation, however, it is possible to send an anonymous email. Below, we’ll walk you through it step-by-step.
Step 1: Connect to a VPN
Normally, whoever owns the network you’re using can monitor your activities. In other words, public wifi hotspots aren’t as helpful as you might think when it comes to gaining anonymity. This is also why it’s not a good idea to send sensitive emails while at work. Of course, even on your home connection, your ISP can see what you get up to, so that’s not much safer.
The solution is simple: connect to a Virtual Private Network (VPN). These services encrypt your traffic so that nobody monitoring the network can see which sites you visit or what you do there. As an added bonus, VPNs hide your real IP address. This ensures that no one, not even the recipient, knows where you’re sending the message from.
WANT TO TRY THE TOP VPN RISK FREE?
NordVPN is offering a fully-featured risk-free 30-day trial if you sign up at this page. You can use our top-rated VPN with no restrictions for a month. It’s perfect for anyone who wants to communicate anonymously over email, even if you’re expecting a long back-and-forth conversation.
There are no hidden terms—just contact support within 30 days if you decide NordVPN isn't right for you and you'll get a full refund. Start your NordVPN trial here.
If you access your email through a web browser, then we recommend combining your VPN with your browser’s incognito or private browsing mode. These modes will prevent websites from storing identifiers on your device, such as cookies.
Step 2: Create a new email address
Here’s the golden rule: if you don’t want your messages traced back to you, never use your real email address. We strongly advise against using any of your existing addresses, especially if it was provided to you by your employer. Instead, it’s better to create a throwaway email address (sometimes called a “burner”) that you’ll use for this task then abandon forever.
It’s important to choose your email provider carefully. Some, like Outlook, require you to provide personal information when signing up. Others might ask for payment information or a recovery email, both of which could lead back to you.
We recommend using a privacy-first email service like ProtonMail. This lets you create an account without providing any personal info, and has an end-to-end encryption feature that makes sure nobody other than the recipient can see what you’re talking about.
It’s also possible to get self-destructing email addresses using services like 10 Minute Mail or Guerrilla Mail without any signup process at all. Obviously, these are a good choice for one-off messages but don’t really give recipients much time to reply.
Step 3: Prepare your message
Think carefully about the contents of your message. It’s important to get your point across without revealing anything that could potentially reveal your identity. There’s a delicate balancing act to perform here, since reputable journalists will need enough info to verify you’re a legitimate source. We’d suggest providing as little detail as possible. For instance, instead of saying “I was CFO at Company X from 2010–2020”, you could say something like “I was a high-level employee at Company X for 10 years and witnessed XYZ”.
You may be asked to provide supplemental proof, such as a company pay stub. If you decide to add attachments to your email, it’s important to redact any identifiable information. You can quickly put a black box over sections of an image using a tool like MS Paint or MacOS’ Paintbrush. We’d advise against using a word processor or programs like PhotoShop for redaction, because these give the recipient more ways to unmask you. This isn’t a rare occurrence, either: even governments regularly fail to redact text properly using these services.
Finally, you’ll want to remove any metadata from your attachments before adding them to the email. Every file stores information such as when it was created and which user did so. It’s even possible to tell where a photo was taken and what camera you used. We’ve created a guide to deleting metadata manually, though there are various online tools for this purpose as well.
When you’re ready, send the anonymous email and disconnect from the VPN (or switch to a different VPN server). This ensures that you’re not inadvertently browsing the web with the same IP address that sent the message.
What’s the best way to message someone anonymously online?
It takes a fair amount of preparation to send an anonymous email. Luckily, that’s not your only option. These days, many journalists accept tips over encrypted messaging services like Signal or Telegram. Some organizations even have their own SecureDrop pages on the dark web, allowing you to deliver information to them near-completely anonymously.
Sending anonymous emails: Frequently Asked Questions
Can emails be tracked?
Yes, your emails can be traced back to you. Just about every major provider scans your messages to detect spam or see if you’re sending malicious links, and there have been numerous legal cases where email services provided records of previously-deleted emails to law enforcement. Additionally, most large organizations use some form of email-monitoring software to keep track of who said what on company accounts.
To send an anonymous email, you’ll have to hide your true IP address and make sure your real identity isn’t linked to the account in any way. This is harder than you might think, which is why we recommend reading our guide to staying anonymous online.
Are my emails encrypted?
Most email services employ some form of encryption. That said, there are several potential problems to be aware of. For instance, Gmail sends your data over HTTPS and TLS, meaning it’s encrypted until it reaches the recipient’s inbox.
For this to work, though, the other person’s provider also has to support TLS encryption. Additionally, if the other person accesses their email service using standard HTTP, anyone monitoring their network could see your conversation. Finally, even if your provider doesn’t record details of every email sent, it’s possible your recipient’s service does.
How do I stop someone from emailing me?
The easiest way to prevent someone from contacting you over email is to block them. Follow these steps to block senders on the most popular email clients:
- Outlook: Click the three dots beside the Print button and hit Block
- Gmail: Click the three dots in the top-right and press the Block button
- ProtonMail: Tap the sender’s address, then Block messages from this sender
- Apple Mail: Hover over sender’s name and choose Block Contact
If you’re dealing with an influx of spam or are being harassed by someone who keeps creating new accounts, you might want to block certain keywords instead. Be aware that this will reject any legitimate emails that also contain that word, so this is really a last resort. Here’s how to ban certain phrases in your email client:
- Outlook: Click the gear icon and select Rules, then Add new rule. Choose Message body includes and enter the phrase you’d like to block. Finally, choose Delete or Mark as Junk in the last drop-down menu
- Gmail: Click the gear icon then See all settings. Move to the Filters and Blocked Addresses tab. Hit Create a new filter and enter your phrase into the Has the words field. Finally, click Create filter
- ProtonMail: Hit the gear icon and select All settings. Choose Filters, then Add filter. Give it a name, choose “The subj
Is the government monitoring my emails?
Unfortunately, just about every government has some way to read your emails. The only difference is that some countries are more open about it than others. For example, China and Iran barely hide the fact that they monitor citizen’s emails and online activities. The US, meanwhile, quietly surveilled Americans’ online activity for years, and this was only revealed as a result of Edward Snowden’s whistleblowing.
Even if your country doesn’t personally monitor what you do online, another might. The UK, for instance, has pretty strict rules about when it’s allowed to intercept user data. However, as part of the Five Eyes intelligence alliance, it can just ask another country to spy on you and share whatever it finds out.
There’s no foolproof way to protect yourself from government surveillance. The best you can do is follow cybersecurity best practices, reduce your digital footprint, and most importantly, not do anything that would land you on the watchlist of a major intelligence agency.
