Apple’s Hide My Email tool fails to protect real addresses. A vulnerability allows almost anyone to discover the actual email linked to an account that the feature was designed to hide. Security researcher Tyler Murphy and 404 Media confirmed the flaw is still active as of Monday.
The flaw
Murphy, co-founder of EasyOptOuts, discovered the issue and reported it to Apple over a year ago. He told the publication that users deserve to know attackers could find their hidden addresses.
“Free, publicly accessible people-search sites make it easy to link an email address to other personal details, so people relying on Hide My Email for safety may be at risk,” Murphy added.
Hide My Email is a paid feature within iCloud+. It generates anonymous addresses, typically two random words and a number ending in @icloud.com. Users apply these to sign up for services or contact people without exposing their primary identity. The goal is to reduce spam, prevent unwanted data linking, and lower the impact of future breaches.
404 Media tested the problem by generating a new address and handing it to Murphy. Five minutes later, he returned the real email associated with that account. Murphy noted that in limited tests with volunteers, 100% of the addresses were exploitable.
Apple’s response
Murphy first notified Apple in June 2025. The company replied a month later stating it was investigating. In March, Apple claimed it had addressed the issue in a recent system change. Murphy found the problem persisted and sent further details.
Apple responded again in March, saying it was looking into the matter. It maintained the investigation was ongoing in May, at which point it asked researchers not to disclose information until the inquiry concluded.
Murphy suggested Apple should stop selling the feature until the fix was ready. At the end of May, Apple stated it planned to address the issue in a security update expected in the coming weeks.
Murphy contacted 404 Media on Monday to share his findings. He added that he did not know why the fix had not been deployed but felt waiting was no longer an option. Apple did not respond to multiple requests for comment.
Separately, TechCrunch reported in June that Apple plans to change Hide My Email to make it less effective. Generated addresses will move from the @icloud.com domain to @private.icloud.com. This change allows websites and services to more easily block signups from those addresses.
What it means
Users relying on this tool for privacy are currently unprotected. The feature offers no guarantee that an anonymous address will remain anonymous. The upcoming domain change will further reduce the tool’s utility by allowing services to block the addresses outright.
