--- title: Brave adds email aliases and a... description: Brave desktop version 1.94 introduces Email Aliases, which generate forwarding addresses to block server-side email matching used by ad platforms like Meta,... canonical: https://daily.dev/posts/brave-adds-email-aliases-and-a-password-never-leaves-your-device-login-system-m8xqdf6gf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Brave adds email aliases and a password-never-leaves-your-device login system | daily.dev og:description: Brave desktop version 1.94 introduces Email Aliases, which generate forwarding addresses to block server-side email matching used by ad platforms like Meta,... og:url: https://daily.dev/posts/brave-adds-email-aliases-and-a-password-never-leaves-your-device-login-system-m8xqdf6gf og:image: https://api.daily.dev/og/posts/M8xqDF6gf.png og:image:alt: Brave adds email aliases and a password-never-leaves-your-device login system og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Brave adds email aliases and a password-never-leaves-your-device login system **[Collections](https://daily.dev/sources/collections)** · 3 min read · 1 upvotes · 0 comments ## Summary Brave desktop version 1.94 introduces Email Aliases, which generate forwarding addresses to block server-side email matching used by ad platforms like Meta, Google, and LinkedIn. Aliases require a new Brave Account, built on the OPAQUE protocol (RFC 9807), which authenticates users without ever transmitting their password to the server, even as a hash. Five aliases are free, with mobile support and a paid Premium tier planned. OPAQUE's export key may later power a password-based Sync alternative to Brave's current QR-code pairing. ## Content Brave version 1.94 introduces two privacy features that work together: Email Aliases and a new account system called Brave Accounts that underpins them. ## Email aliases When you click an email field on a signup form, Brave now offers to generate a disposable alias address. The alias forwards incoming mail to your real inbox, but the site never sees your actual address. This matters beyond the obvious. Ad tech companies at Meta, Google, LinkedIn, and others do server-side email matching: they hash the email address you gave a site and compare it against their own databases to track you across the web. Browser-level tracker blocking doesn't stop this because it happens on the server. Aliases break the match since the address the site has isn't your real one. Brave says it doesn't read the contents of forwarded emails. It performs spam and virus filtering, then deletes messages from its servers within seconds of forwarding. Account data is encrypted at rest, and locally-stored notes are end-to-end encrypted if synced. The free tier includes five aliases. A paid Premium tier is planned to remove that cap. Mobile support is also coming. One practical note: forwarded mail may land in spam initially while Brave builds its sender reputation. To use it, you need a Brave Account with a registered primary email for forwarding. Setup is at `brave://settings/getStarted`. ## Brave Accounts and the OPAQUE protocol The account system uses OPAQUE (standardized as RFC 9807 in July 2025), a password-authenticated key exchange protocol. The short version: your password never leaves your device, not even as a hash. Traditional login systems send your password or a hash of it to the server. If the server is breached, attackers get those hashes and can run cracking attempts against them. With OPAQUE, the server never receives the password or hash in any form. It uses an oblivious pseudorandom function combined with Argon2id key derivation, so precomputed cracking tables are useless and a full database breach still requires an expensive per-account offline attack to recover anything. OPAQUE also produces what's called an export key, which can be used for end-to-end encryption. Brave plans to use this for a new password-based Sync option alongside the existing QR-code pairing method. Worth being clear about what OPAQUE doesn't fix: it doesn't protect against phishing or weak passwords. It specifically addresses the server-side exposure problem. Brave Accounts are separate from Brave Premium and are free to create. ## Questions this post answers ### What is the OPAQUE protocol and why does Brave use it for login? OPAQUE is a password authentication protocol, standardized as RFC 9807 in July 2025, that lets a user prove they know a password without ever sending it to the server, even hashed. Brave's new Accounts system uses OPAQUE combined with an oblivious pseudorandom function and Argon2id key derivation, so a server breach yields no password hash to crack with precomputed tables, only an expensive per-account offline attack. _Developers weighing authentication schemes can track protocol adoption like OPAQUE's on daily.dev._ ### How do Brave's email aliases prevent server-side email matching by ad platforms? Brave Email Aliases generate a unique forwarding address, such as xyz@brave-alias.com, that a website sees instead of your real email, so ad platforms like Meta, Google, and LinkedIn cannot use it to match you against a cross-site tracking profile. Brave states it does not read forwarded message contents, only scans for spam and viruses, and deletes messages from its servers within seconds. Five aliases are free. _Anyone comparing privacy tools against ad-tracking techniques can follow releases like this on daily.dev._ ## Similar posts on daily.dev - [AliasVault Is The BitWarden Alternative You Didn't Know You Needed](https://daily.dev/posts/aliasvault-is-the-bitwarden-alternative-you-didn-t-know-you-needed-a7uqhyxvb) · It's Foss · 0 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#privacy](https://daily.dev/tags/privacy) [View this post on daily.dev](https://daily.dev/posts/brave-adds-email-aliases-and-a-password-never-leaves-your-device-login-system-m8xqdf6gf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Brave adds email aliases and a password-never-leaves-your-device login system","url":"https://daily.dev/posts/brave-adds-email-aliases-and-a-password-never-leaves-your-device-login-system-m8xqdf6gf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/brave-adds-email-aliases-and-a-password-never-leaves-your-device-login-system-m8xqdf6gf"},"datePublished":"2026-08-28T19:36:16.557Z","dateModified":"2026-08-29T14:30:44.972Z","description":"Brave desktop version 1.94 introduces Email Aliases, which generate forwarding addresses to block server-side email matching used by ad platforms like Meta,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fc2f7ff391b58bd6f58261e683909303?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fc2f7ff391b58bd6f58261e683909303?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/brave-adds-email-aliases-and-a-password-never-leaves-your-device-login-system-m8xqdf6gf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,privacy","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Brave adds email aliases and a password-never-leaves-your-device login system"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/brave-adds-email-aliases-and-a-password-never-leaves-your-device-login-system-m8xqdf6gf#faq","mainEntity":[{"@type":"Question","name":"What is the OPAQUE protocol and why does Brave use it for login?","acceptedAnswer":{"@type":"Answer","text":"OPAQUE is a password authentication protocol, standardized as RFC 9807 in July 2025, that lets a user prove they know a password without ever sending it to the server, even hashed. Brave's new Accounts system uses OPAQUE combined with an oblivious pseudorandom function and Argon2id key derivation, so a server breach yields no password hash to crack with precomputed tables, only an expensive per-account offline attack. Developers weighing authentication schemes can track protocol adoption like OPAQUE's on daily.dev."}},{"@type":"Question","name":"How do Brave's email aliases prevent server-side email matching by ad platforms?","acceptedAnswer":{"@type":"Answer","text":"Brave Email Aliases generate a unique forwarding address, such as xyz@brave-alias.com, that a website sees instead of your real email, so ad platforms like Meta, Google, and LinkedIn cannot use it to match you against a cross-site tracking profile. Brave states it does not read forwarded message contents, only scans for spam and viruses, and deletes messages from its servers within seconds. Five aliases are free. Anyone comparing privacy tools against ad-tracking techniques can follow releases like this on daily.dev."}}]} ```