The idea
A self-hosted alternative to SimpleLogin or AnonAddy, paired with a browser extension that removes the copy-paste step: click the extension icon on any signup form, it generates a new alias tied to that domain, fills the email field, and registers the forwarding rule on your own mail server — all in one action. No dashboard tab-switching required to get a working alias.
Why build this
Existing alias services (SimpleLogin, AnonAddy/addy.io, Firefox Relay) work well but push you through their web dashboard to mint an alias, then back to the tab where you're signing up to paste it. That friction is why most people fall back to reusing one real address. Self-hosting removes the trust-a-third-party problem (they see every alias you create and every email that flows through), and a browser extension removes the friction problem. Now is a good time because Cloudflare Email Routing and Mailgun both expose simple APIs for catch-all forwarding rules, so the mail-handling side no longer requires running your own SMTP stack.
Stack sketch
- Backend: Go or Node service exposing a small REST API (
POST /aliases,GET /aliases,DELETE /aliases/:id) backed by SQLite - Mail routing: Cloudflare Email Routing API (free tier, catch-all + per-alias rule creation) as the default provider, with a Mailgun adapter as a fallback for non-Cloudflare domains
- Auth: single API token generated at install time, stored in the extension's local storage — no multi-user accounts for v1
- Browser extension: Manifest V3, vanilla TypeScript, content script that detects the focused
input[type=email]and injects a small "generate alias" button beside it - Alias naming:
{site-slug}-{random4}@yourdomain.com, derived from the page's registrable domain so you can trace back which alias leaked - Deployment: single Docker container alongside your existing self-hosted stack, fronted by Traefik like any other internal service
Scope for v1
- One mail provider integration (Cloudflare Email Routing) — others come later
- Extension supports Chrome and Firefox via the same MV3 codebase
- Alias list view in the extension popup: site, alias, created date, forward-to toggle (on/off, not delete, so history is preserved)
- No per-alias custom forwarding address — everything forwards to one inbox, set once during setup
- No shared/multi-user support; this is a personal tool
Where it could go
The natural next step is per-alias forwarding overrides, so you can point specific aliases at different inboxes (personal vs. a shared family address) or auto-disable an alias after it starts receiving spam above a threshold. A second expansion is a "breach report" view that cross-references which alias domains have shown up in known breach dumps (via the HaveIBeenPwned API), so you get a concrete signal for which service leaked your address instead of a vague suspicion. Further out, a CLI companion for generating aliases from the terminal would round out the tool for people who sign up for things via API docs and test accounts rather than browser forms.
Watch out for
Cloudflare Email Routing's free tier caps the number of routing rules per zone (currently in the low thousands), which is generous for personal use but worth surfacing in the UI before someone hits the wall silently; also, MV3's content-script injection into arbitrary sign-up forms is inherently fragile against shadow-DOM and iframe-embedded forms, so plan for a manual "copy alias" fallback from day one rather than treating auto-fill as guaranteed.