Cloaked Review | PCMag

It’s easy to despair that online privacy is impossible. Everywhere you go, advertisers and others track you. Even when you try to be careful, you frequently have to give out your email, which inevitably gets used in spam messages. But is it truly inevitable? Using a temporary email service like Cloaked, you can communicate online without revealing your actual email. Cloaked goes beyond the basics, with shielded texts, password management, and even a degree of identity theft protection. However, Editors’ Choice winner IronVest offers a very similar feature set for less than a quarter of the price.

How Much Does Cloaked Cost?

There’s a wide range of prices with temporary email services, though most come in from around $30 to around $60. SimpleLogin costs $30 per year, for example, and Burner Mail is a penny less. IronVest is just under $40, Private-Mail is just under $50, and StartMail is just under $60.

Aside from these, there’s another price point—free. Bulc Club, ManyMe, and Skiff don’t cost a penny. Yes, ManyMe and Skiff offer paid tiers with advanced features, but you get all the basics for free.

Then we have Cloaked, which at $180 per year is more than twice the priciest competitor. To be fair, Cloaked goes well beyond providing temporary emails with a fully integrated password manager, the ability to hide your actual phone number, and elements of identity theft protection. However, IronVest offers many similar bonus features and costs quite a bit less.

It’s Surprisingly Easy to Be More Secure Online

Cloaked does offer a million-dollar insurance policy against identity theft, albeit without the detailed monitoring of dedicated identity theft remediation services. Some of those services cost even more than Cloaked. For example, Avast One Platinum costs $299.99 per year and IDX Complete runs $355.52. Note, though, that both include a full range of identity and privacy monitoring, along with security suite protection for your devices. Avast in particular protects six identities and 30 devices.

Bitdefender Ultimate Security, ESET Home Security Ultimate, and IDShield all cost about the same as Cloaked, and include protection for 10, five, and three devices respectively. Norton 360 with LifeLock charges $149.99 per year, which gets you security suite and VPN protection for five devices, along with identity theft protection. Even in this realm, Cloaked is expensive.

Getting Started With Cloaked

You don’t have to pony up a year’s subscription to try Cloaked. You can give it a whirl for 14 days without even supplying a credit card number. Do take advantage of the free trial and put the service through its paces before you decide whether to subscribe.

(Credit: Cloaked/PCMag)

Bear in mind that this app will hold some very sensitive information, from messages stored in the online inbox to the passwords for your most sensitive accounts. Make sure you create a strong, unique master password to protect that information, and consider layering on multi-factor authentication (MFA), which I’ll discuss below.

Simple Tricks to Remember Insanely Secure Passwords

After the simple signup process, Cloaked works hard to make sure you understand all its features. Explanatory popups provide education without getting too intrusive. By accomplishing simple tasks, you steadily move the Getting Started meter toward 100%. It doesn’t take a lot. Log into the web version, install a mobile app, try the browser extension, create one new identity—all these actions boost your score.

The Core of a Cloaked Identity

For privacy’s sake, you don’t want to give away your real identity, but in many situations, you can’t escape providing some identity information. That’s where Cloaked identities come in.

At the core of an identity is a pair of email addresses, one real and one temporary. Cloaked generates the temporary email address for you. By observation, it uses three random words such as cease.click.trace or screw.cute.cheap (these are both real-world examples) for the email name. You can generate it again if you don’t like the random email, but there’s no option to totally customize it the way you can with most competing products.

(Credit: Cloaked/PCMag)

Bulc Club, ManyMe, and SimpleLogin take the custom address concept to the next level. With these services, you can create a custom masked address on the fly without using a computer or other device. The address becomes active the first time it’s used.

Also essential is the actual email address that will receive forwarded messages sent to the fake address. Conveniently, you can associate different Cloaked identities with different real addresses. With Bulc Club and StartMail, all forwarded mail goes to your main account email. ManyMe is even tougher; you can’t change your email after signing up. Burner Mail swings the other way, letting you forward a single burner email to multiple real-world addresses.

There’s More to a Cloaked Identity

I mentioned forwarding emails to your real-world address, but you can also create identities without forwarding. In that case, your only access to received emails is through Cloaked’s own online inbox. For each identity, you can optionally add associated contacts and block access for those not on the list.

As I describe in detail below, Cloaked is also a full-scale password manager, using the same identity system that provides temporary email addresses. Each identity can store a username and password pair. There’s even an option to have Cloaked provide multi-factor authentication codes, taking the place of Google Authenticator or another authenticator app. Password managers Bitwarden and Enpass, among others, likewise have authentication built in.

(Credit: Cloaked/PCMag)

Cloaked offers the unusual ability to create a cloaked phone number for each identity. As with cloaked emails, you can choose to forward texts to an actual phone number or just look at them in the online inbox. IronVest is the only competitor that offers a similar feature, but its masked phone number feature is more limited. There’s no inbox to catch texts, and you get just one masked phone number.

Hands On With Cloaked Identities

The easiest way to use your cloaked identity options online is through the handy browser extension. When you visit a site that asks for your email address, Cloaked offers to generate one for you. Accept the offer and you’ve created a new identity, titled for the page’s title, with the URL and your brand-new cloaked email address recorded. Any mail from that site will get forwarded to the corresponding real-world email address you’ve selected, and will also appear in the online inbox.

(Credit: Cloaked/PCMag)

I found that forwarded messages came with a little banner from Cloaked saying, “Only you can see this. Your message is secure.” My company contact explains that this simply means the email system you’re using is client-side encrypted. It’s not about anything Cloaked did.

(Credit: Cloaked/PCMag)

At this point, you’re on a roll. You receive messages sent to the cloaked email, and your replies seem to come from that email. If you get spam sent to an identity, you know that the contact for that identity sold you out (or got hacked). If that happens, you can delete the identity or stop forwarding messages. Better still, you can lock it down so only mail from existing, known contacts goes through.

As noted, you can add a cloaked phone number to any identity, which is handy when you need to receive a texted security code. By default, the first text from a new cloaked number goes through to the online inbox and, if you’ve enabled forwarding, proceeds to your mobile phone. Texts from other numbers also get held pending your approval. Calls work in a similar fashion.

(Credit: Cloaked/PCMag)

You won’t necessarily know who’s sending texts to your cloaked numbers. On your mobile, the text appears to come from the cloaked number, not from the actual sender. You can reply—just be sure you know who you’re replying to.

Multi-Factor Authentication, Two Ways

Anyone who managed to hack, steal, or guess your Cloaked password would get full access to your cloaked identities and online inbox. If you’re using Cloaked as a password manager, they now own all your accounts. You can head off this disastrous outcome by adding multi-factor authentication (MFA) to protect your account.

What Is Two-Factor Authentication?

The most common type of MFA involves syncing Google Authenticator or another authenticator app with the service you want to protect. The app and the service both generate a new security code every 30 seconds. Logging in requires you to enter both your master password and the current code.

(Credit: Cloaked/PCMag)

Cloaked gives you two MFA choices, neither of which is the more secure app-based MFA. You can have it send a code as an SMS text message or as an email. Using either of these is still vastly better than going without MFA, of course, but it’s not as good as it could be.

Cloaked Password Manager

The Cloaked browser extension watches your online activity and offers help when you need to enter a new (or existing) cloaked email. That same extension handles Cloaked’s password management features, capturing and replaying the passwords you enter and offering full access to those you’ve saved.

Import Passwords to Start

If you’re a regular PCMag reader, you probably already have a password manager. Even if not, you may have accepted your browser’s offer to save passwords for you. There are various strategies for switching to a new password manager, but the easiest way is to import from your existing collection. And hey, importing passwords is one of the Getting Started tasks that gains you points.

(Credit: Cloaked/PCMag)

Cloaked can import from Brave, Chrome, Edge, Firefox, Opera, and Safari, as well as from Apple Keychain. Its list of competitors supported for import is rather short: 1Password, Bitwarden, Dashlane, Keeper, and LastPass. Bitwarden, by contrast, imports from almost 50 competing password managers.

In testing, I found importing from Keeper to be a challenge. I exported my Keeper data as instructed and tried powering through the import process. Given that Keeper is listed as a supported source, I figured it should just work. I was wrong. First, Cloaked treated the first line of data as headings. I edited the CSV file to add an actual headings row and tried again.

This time around, I found that the all-important username and password entries didn’t all show up in the same columns, making import impossible. After some hair-tearing, I found the problem. Keeper’s first data column is the item’s folder location. When that column was empty, instead of treating it as empty, Cloaked shifted all the other columns to the left. By editing the exported CSV to change all those empty cells to “NoFolder,” I managed to complete the import.

(Credit: Cloaked/PCMag)

My Cloaked contact suggested that the problem was due to a recent change in Keeper’s export format. However, Keeper’s CTO reported no recent changes when I asked. In any case, I eventually succeeded in importing the data. Alas, Cloaked simply ignored the folder information.

There was one more minor problem. Almost a third of the imported entries came through marked “Needs Review.” A little study revealed that almost all of these had a username that’s not an email address. Cloaked doesn’t believe in those, so I had to have it ignore them.

Password Capture and Replay

Using a password manager has to be easy, or else consumers will go back to pet names and sticky notes. Like all successful password managers, Cloaked automatically captures your credentials when you log in to a secure site. When you’re signing up for a new login, you can have it generate a strong password, something virtually all competitors do. But it also asks if you would like to create a cloaked email address. The password manager in IronVest does something similar.

(Credit: Cloaked/PCMag)

By observation, the password generator creates 20-character passwords using all four character sets: uppercase letters, lowercase letters, digits, and symbols. You can un-check letters, digits, or symbols if you encounter a site with restrictions. There’s also an option to generate easy-to-remember passwords like sign.horse.bulb or thus.cave.class.

(Credit: Cloaked/PCMag)

When you revisit a site that matches an existing identity, Cloaked offers to fill it. If you’ve got more than one match, it provides a simple menu for you to choose from. In testing, I didn’t find a site it couldn’t handle.

Form Filling for Personal Data

Like most password managers, Cloaked leverages its ability to fill login credentials, expanding to fill personal data on web forms. To get started using this feature, click your name at the top right of the main dashboard and select Personal Information from the menu that appears at the left.

(Credit: Cloaked/PCMag)

Cloaked stores your personal data in small bites: Name, Birthday, Gender, and Address. Fill in the data carefully, and be sure to click Save Changes. If you click Back without saving, you’ve lost those changes.

Dashlane and RoboForm are among the password managers that allow multiple entries in personal data fields. With Cloaked, you just get one. However, you can add multiple credit or debit cards as payment methods.

When I tried filling in this data on a standard test page, I found it awkward. Given that there’s only one set of personal data, you might think that clicking to fill in any item would fill them all. Not so; I had to click separately to fill in name, address, and so on. It did help me fill in a credit card, but it omitted the verification CVV.

(Credit: Cloaked/PCMag)

Of course, filling web forms isn’t a primary feature of password management. It’s just a nice bonus. And every field that Cloaked fills is one you don’t have to type yourself.

Automated Cloaking

Cloaked combines password management with a temporary email address system. As you update weak passwords, you should also consider whether you want to switch to a cloaked email. Of course, this entails going to the corresponding website and carefully making that change.

The good news is you don’t necessarily have to perform that labor yourself. Cloaked offers a feature called AutoCloaking that “automatically logs in to websites, creates new secure login details, and saves them in your Cloaked account.”

(Credit: Cloaked/PCMag)

The bad news is that there aren’t very many sites that Cloaked supports for AutoCloaking. The help lists just 10. When I selected the feature in my dashboard, it listed seven of my accounts as available for AutoCloak and invited me to add an identity for another 60 supported sites. Since I’ll be uninstalling Cloaked when my review is complete, I didn’t let it make any permanent changes to my accounts.

Identity Sharing

We at PCMag don’t promote promiscuous password sharing, but sometimes sharing is necessary, like when you share a bank account with a partner. Like most competitors, Cloaked offers secure sharing.

(Credit: Cloaked/PCMag)

Password managers handle sharing in a variety of ways. Dashlane, LogMeOnce, and NordPass are among those that create connected shares. If you’ve given the recipient permission to make changes, those changes will show up in your own password collection. Bitwarden, Keeper, and Proton Pass allow creation of shared folders; everything in the folder belongs to the group.

Click the double-link sharing icon at the top right of an identity to start the sharing process with Cloaked. You can choose to share full details (though without things like associated calls and emails) or only the identity name, URL, email, or password. Either way, it’s a read-only share. 1Password uses a similar system, and it’s an option with Bitwarden.

Cloaked creates a password-protected link that gives the recipient temporary access—for an hour, by default. You transmit the link and, for proper security, send the password by another means. The recipient can now view the information you sent, at least until temporary access runs out.

(Credit: Cloaked/PCMag)

The page that presents this information naturally invites the recipient to join or log in to Cloaked. For testing, I fired up a free 14-day trial on a spare email address. Surprisingly, I found no way to copy or import the shared identity. The best I could do was create a new identity and copy in the data from the share.

What’s Not Here?

Getting your existing passwords stored in a password manager is an excellent first step. However, you’re not truly taking advantage of its service until you replace all your weak and double-duty passwords with strong, unique ones. 1Password, Keeper, and Bitwarden are among the many password managers with a built-in password strength report to help you know just which ones need work. IronVest goes a step further, giving you bonus points for entries that have both a strong password and a masked email address. Cloaked leaves improving your passwords as a DIY task.

Securely sharing login credentials is a handy feature, but what if you’re no longer alive to initiate sharing? Bitwarden, LogMeOnce, and RoboForm, among others, have a built-in system that lets your heirs access your account, with safeguards against too-early access. That’s not something you get with Cloaked.

If you choose Cloaked for its ability to protect your email address and phone number, you won’t go wrong relying on it for password management as well. It doesn’t challenge the best dedicated password managers, but it’s roughly on par with what you get in IronVest.

Identity Theft Insurance

Just before this review, Cloaked added a significant additional feature—a million-dollar identity theft insurance policy backed by AIG. This isn’t the app’s main purpose, though, and it doesn’t include all the identity monitoring features found in actual identity theft remediation apps.

The full terms and conditions for Cloaked’s insurance look familiar. You need to report an identity theft event as soon as possible and no later than 90 days after the occurrence. You can’t be involved in any shady dealings related to the event. Certain payout types have their own sub-limits. For example, the policy will reimburse lost wages at $2,000 per week for five weeks maximum. The big difference is that detecting the identity breach is all on you.

Cloak Is Effective, Integrated, and Expensive

Managing temporary email addresses and automatically filling them in as necessary isn’t a lot different from storing and filling login passwords. Cloaked manages to do both, smoothly integrating the two functions, with identity theft insurance as a bonus. That said, IronVest also integrates password management with masked emails and includes bonuses such as an active Do Not Track system—and its price is less than a quarter of what you pay for Cloaked. As such, IronVest is our Editors’ Choice winner for temporary email services.