What GitHub Shows About Your Email Address

You tick “Keep my email addresses private”, push a fix, and publish your email address.

Consider a hypothetical developer, Jane. She’s enabled that setting, but Git on her computer still has jane@acme.com as its user.email. She hasn’t enabled GitHub’s separate push-blocking setting. When she commits a fix and pushes it to a public repository, the address goes with it. A stranger adds .patch to the commit URL and reads it without signing in.

Jane changes her Git configuration to GitHub’s no-reply address. Her next commit uses it. The fix she already published still carries jane@acme.com. The checkbox never reached her computer.

What we found in 300 accounts

On 5 November 2026, we counted 300 accounts: 25 that joined in March of each year from 2012 to 2023, found through GitHub’s user search. Each had at least five followers and five repositories. We read up to 100 commits from each account’s three most recently pushed non-fork repositories.

This is a small, non-random sample. We classified each address and discarded it; we retained neither addresses nor usernames. We didn’t test whether any address still receives mail. “Real-looking” here means an address that isn’t GitHub’s no-reply.

What we counted	Result
Accounts listing an email on their profile	108 of 300
Accounts with commits we could read	289
Those with a real-looking address in at least one commit	247 of 289
Accounts with a commit from the past two years in those repositories	251
Those whose newest commit carried a real-looking address	182 of 251 (73%)
Those whose newest commit used no-reply	69 of 251
Of those 69, accounts with a real-looking address in older commits	34

Those last 34 are a floor. We stopped at 100 commits per repository and three repositories per account. Looking further back could find more. Reading only the newest commit would have missed all 34.

Who can see your profile email

The “Public email” setting chooses the address displayed on your profile. GitHub’s API documentation says: “You only see publicly visible email addresses when authenticated with GitHub.” A free account is enough. The reader needs to sign in, not know you or pay GitHub.

We tested 20 well-known accounts with public addresses on 5 November. Authenticated API requests returned them. Anonymous requests returned null in all 19 that answered; one account didn’t answer anonymously. A null response is therefore no proof that the owner hasn’t published an address.

We also requested all 20 profile pages without signing in. Nineteen contained no address. The twentieth did: its owner had typed it into their profile README. Your bio and README are public text. An email privacy setting cannot conceal an address you’ve written into the page.

Your commits carry their own address

Git writes the user.email configured on your machine into each new commit you author, unless you’ve explicitly overridden it. That address is part of the commit itself. Git’s configuration documentation describes the author and committer fields; neither is a live reference to your GitHub profile.

GitHub’s privacy instructions specify “web-based Git operations”. The checkbox’s label assumes you already know where GitHub ends and Git begins. Editing a file on GitHub and committing from your terminal use different settings. The address you configure locally “will be visible in any future commits you push to GitHub”.

We ran this without signing in:

curl -sL https://github.com/octocat/Spoon-Knife/commit/d0dd1f6.patch | head -2

From d0dd1f61b33d64e29d8bc1372a94ef6a2fee76a9 Mon Sep 17 00:00:00 2001
From: The Octocat <octocat@nowhere.com>

The address is on the second line. Anyone cloning the public repository gets that history too; git log reads the same address from their copy.

Check what you’ve published

Inside a repository, start with Git’s current configuration and the addresses in your existing commits:

git config user.email
git log --author="Your Name" --format='%ae' | sort -u

Replace Your Name with your commit author name. The first command shows the configured address now. The second lists distinct author addresses in matching commits reachable from the current branch. Repeat for other names you’ve used and other repositories; add --all to include all local refs.

Open one of your public commits without signing in and append .patch to its URL. Read the From: line. Then inspect any GPG keys you’ve uploaded, substituting your username:

curl -sL https://github.com/YOUR-USERNAME.gpg | gpg --show-keys

A key’s user ID often contains an email address. An account without an uploaded key returns a note saying so, not a key for GPG to inspect.

Finally, inspect “Public email” in your profile settings, your bio and your profile README. Look both signed in and signed out: our tests show why the signed-out view alone is insufficient.

Older guides also point to the public events feed. That direct route has closed. GitHub announced “Removing commit summaries and counts that require slow external calls” on 8 August 2025, with implementation on 7 October. The push-event payloads we read on 5 November 2026 contained only repository_id, push_id, ref, head and before. The commits themselves remain readable.

Keep your address out of new commits

In GitHub’s Settings → Emails, enable “Keep my email addresses private”. This covers commits made through GitHub’s web interface.
Enable “Block command line pushes that expose my email” too. GitHub checks the most recent commit. If its author address matches a private email on your account, GitHub will “block the push and warn you about exposing your private email”. This isn’t a scan of your entire history.
Copy your no-reply address from that settings page. Use the exact address GitHub gives you:
```
git config --global user.email "ID+USERNAME@users.noreply.github.com"
```
Do this on every machine you commit from. Inside each repository, run git config user.email again. A repository’s own setting overrides the global one. If it still shows your old address, replace that local setting too:
```
git config user.email "ID+USERNAME@users.noreply.github.com"
```

GitHub’s email reference distinguishes two formats. Accounts created after 18 July 2017 use ID+USERNAME@users.noreply.github.com. Older accounts that enabled privacy before that date can have USERNAME@users.noreply.github.com. The ID-based form keeps commits linked to your account if you change username; the older form doesn’t.

Old commits don’t change with your settings

Jane’s old patch survives because changing user.email only changes future commits. To replace the address in existing history, she’d have to rewrite that history: create replacement commits containing the new address, then publish those in place of the originals.

GitHub’s removal guidance uses git-filter-repo and warns: “Rewriting history will change the hashes”. Collaborators must coordinate the cleanup. Forks retain their copies, and “You cannot remove sensitive data from other users’ clones of your repository”.

Old commits can also remain accessible through cached SHA-1 URLs and pull-request references. GitHub Support can remove those cached views and references, but only assists with sensitive-data removal when it determines that rotating affected credentials cannot mitigate the risk.

We’d treat an address you’ve committed with publicly as public, use no-reply from now on, and filter or retire the old address if the mail becomes a problem.

If you’re looking for a developer’s address

A GitHub no-reply address goes nowhere. Another address might belong to a previous employer, have been abandoned years ago, or never have belonged to that developer. Git lets the author supply it. Our Octocat example is reported by GitHub’s API as "verified": false, with reason unsigned. An address in a commit isn’t proof of identity. Our reverse email lookup tool shows who’s on record for a company address.

GitHub’s Acceptable Use Policies, section 7, prohibit using information from the service “for spamming purposes, including for the purposes of sending unsolicited emails to users or selling personal information”, including to recruiters, headhunters and job boards. Finding an address doesn’t confer permission to send a pitch. Where contact is invited, write to one person, about their work, and say how you found them.

Our GitHub email finder starts from a username, works out who the account belongs to, then looks for their contact record. Anyone can remove themselves from Nameclick.