33Mail vs GhostRelay

33Mail creates private email aliases and forwards messages sent to them to an existing email address. An alias is created automatically when email first arrives, and users can block an alias to stop receiving its messages. With anonymous replies enabled, users can reply to forwarded mail through 33Mail; the service removes header information relating to their actual email address. Premium accounts can use a custom domain by pointing its MX record to 33Mail. The service is web-based and also lists a browser extension. Lite is free and includes 10MB monthly bandwidth, with alias creation limited to five per 30-minute period. Premium costs $1 a month and includes 50MB monthly bandwidth, 20 anonymous replies per day, one custom domain, and one additional username. Pro costs $5 a month; Enterprise costs $50 a month. Attachments up to 10MB count toward bandwidth, which is measured over a rolling 30-day window. 33Mail says it warns users who exceed their bandwidth limit and treats dropping emails as a last resort. Its terms say user data is used to provide the service and is not shared with third parties except as needed for law enforcement requests. Brothers Ian and Andrew Clarke conceived the service, which forwarded its first email in August 2010.

GhostRelay is a web service that creates email aliases and forwards their messages to a real inbox. Users can make random or custom aliases, monitor them, and disable or delete them from a dashboard. The free plan costs nothing, requires no credit card, and allows up to 20 aliases with unlimited forwarding, custom names, and enable or disable controls. Forwarded messages preserve the Reply-To header, and the service supports replying from an alias. Mail can be sent to any receiving address, including Gmail, Outlook, Yahoo, ProtonMail, and iCloud. Disabled aliases reject incoming messages and return a bounce to the sender. GhostRelay says email is processed in memory without disk or database storage and content is not retained. It describes TLS 1.3, AES-256, bcrypt hashing, and signed JWT authentication. Custom domains and a browser extension are available; mobile apps and a public API are not.