Why a secondary address can expose the wrong identity
A secondary Proton address is still you, but it may not look like you. The From field combines two separate things: the email address itself and the sender display name attached to that address. A signature adds a third layer inside the message body. When you send from a secondary address, any of these can carry an identity you did not intend — a pseudonym, an old project name, or a blank display name that falls back to the raw address.
Proton Mail’s display name is what recipients see in the From field; if left blank, they usually see the email address.
Proton Mail’s display name is what recipients see in the From field; if left blank, they usually see the email address. Source
That fallback is the first trap. A blank display name is not neutral: it exposes the address string itself, which may be more identifying than a name you would have chosen. The second trap is assuming that a display name you set once applies everywhere. Different addresses can carry different identities, so a review has to be per-address, not per-account.
Step 1: Open the identity settings
The review starts in the place where Proton stores display names and signatures. Settings, then All settings, then Identity and addresses, then Display name and signature lets users edit those fields.
Settings, then All settings, then Identity and addresses, then Display name and signature lets users edit those fields. Source
Work through every address listed there, including aliases and any secondary address you rarely use. The goal is not to make them all identical; it is to know exactly what each one sends.
Step 2: Build a per-address review table
Before changing anything, record what each address currently sends. A simple table forces you to look at each identity separately and makes drift visible later.
| Address | Display name shown in From | Signature attached | Intended audience | Action |
|---|---|---|---|---|
| Primary address | Your real name | Standard sign-off | Clients, family | Keep |
| Secondary address | Blank (falls back to address) | None | Forum sign-ups | Set a display name or accept the fallback |
| Project alias | Old project name | Old project footer | Unknown | Update or retire |
| Alias used for one contact | Personal nickname | Personal signature | One recipient | Confirm before sending |
Fill the first three columns from the settings screen, not from memory. The fourth column is your decision: who is allowed to see this identity. The fifth column is the change you will make, if any.
Step 3: Decide what each address should reveal
A display name and a signature are disclosures, not decorations. Use a decision table to keep the choice deliberate.
| Situation | Display name | Signature | Reason |
|---|---|---|---|
| Contacting a stranger from a secondary address | Set a name you are comfortable showing | Short or none | The From field is the first thing they see; a blank name exposes the address |
| Replying from an alias created for a specific group | Match the alias’s purpose | Match the group’s tone | A mismatched identity invites questions |
| Sending a one-off message | Check the current value first | Remove for this message if needed | Defaults may not fit the recipient |
| Address you no longer use publicly | Leave as is or retire it | Leave as is | Changing a display name does not delete the address or old mail |
Different addresses can have different display names and signatures, and a default signature can be changed or removed for an individual message.
Different addresses can have different display names and signatures, and a default signature can be changed or removed for an individual message. Source
That last point matters for one-off messages: you can adjust the signature for a single send without rewriting the default for every future message.
Step 4: Check the composed message before sending
The settings screen is not the last checkpoint. The compose window is where the actual From identity, recipient and signature meet. Before pressing send from a secondary address, run this owner-side checklist:
- Read the From line. Does it show the address you intended, with the display name you expect?
- Read the signature at the bottom. Is it the one you chose for this message, or a default you forgot to change?
- Read the greeting and sign-off. Do they match the identity in the From field?
- Read the recipient. A correct identity sent to the wrong person is still a disclosure.
- If the message is sensitive, remove the signature for this message rather than editing the default.
This checklist is about identity, not account security. It does not require changing passwords, enabling two-factor authentication or reviewing login sessions. Those are separate tasks.
Common mistakes
- Treating a blank display name as anonymous. A blank name usually means the recipient sees the address itself, which can be more identifying than a chosen name.
- Assuming one display name covers all addresses. Each address can carry its own display name and signature, so a review of one address says nothing about the others.
- Changing the display name and expecting old messages to change. A display name edit affects future sends; it does not rewrite the From field of mail already delivered, and it does not recall it.
- Confusing a display name change with a new address. The address stays the same. If the address itself is the problem, changing the name does not solve it.
- Leaving a project signature on a personal message. A default signature can be removed for an individual message, but only if you remember to do it.
- Treating a public profile match as proof of identity. A username match on a public platform is a lead, not proof that the same person owns the address. Matching photos, biographies and handles cannot independently prove identity.
Limits: what a display-name review cannot do
A display-name and signature review is a disclosure check, not an anonymity tool. It cannot hide the address in the From field, and it cannot prevent a recipient from recognizing you by writing style, context or prior contact. It does not reach messages already sent. And it does not tell you what other people can find about you elsewhere.
If your concern is what public accounts are associated with an address or handle you already know, a username lookup can help you see your own known public handles in one pass. TraceSeek is an app that checks a username across 3,000+ platforms and returns results in 20-30 seconds, with a free first scan. It does not change Proton settings, does not access private content, and does not prove identity; treat any public match as a lead to review yourself. For a broader account inventory, see the guide to finding accounts by email address, and for how results are framed, read the methodology page.
Protecting your own footprint
Start with the addresses you control. A per-address review table is worth keeping because identities drift: an alias created for a forum gets reused for a job application, and the display name no longer fits. Review the table whenever you create a new address or repurpose an old one.
When you send from a secondary address, decide in advance what that address is allowed to reveal. If it should reveal nothing, consider whether the address itself is the disclosure you are trying to avoid — because the display name will not fix that. Keep a recovery method you control for any address you plan to retire, and do not treat removal of a login connection as account deletion. An edited or empty profile does not establish deletion of stored data.
Finally, separate the two questions. “What does this message show about me?” is answered by the compose-window checklist. “What can someone find about me publicly?” is a different search, and it deserves its own review rather than a guess.
Key facts
- Proton Mail’s display name is what recipients see in the From field; if left blank, they usually see the email address.
- Settings, then All settings, then Identity and addresses, then Display name and signature lets users edit those fields.
- Different addresses can have different display names and signatures, and a default signature can be changed or removed for an individual message.
- TraceSeek checks a username across 3,000+ platforms and returns results in 20-30 seconds, with a free first scan.
- A public username match is a lead, not proof of ownership.