But not every website out there allows you to enter this as a valid email address.

My earlier hypothesis was that this was on purpose, to make sure you don't use a filter on any email they might send. But these days I'm tending to think it's just a bad regexp on their side.

Even worse, some sites let you enter a plus address initially but that address will not work in some account management pages. I had an instance where I signed up to a pizza place with such an address and I could not unsubscribe or edit my mail preferences because of it.

For example, overstock.com. Their registration page lets you use '+' address, but their login page forbids it.

If you are just starting to do this...it's very easy to forget you did it for a particular site.

"I can't log in and to boot your site says there is no account matching first.last@gmail.com. What kind of Mickey Mouse operation are you running here?"

"Sir, you are an idiot."

If you're using a password manager, that's a non-issue. And until we have something better than passwords, you really should be using one.

That's a solid point. I've generally avoided password managers because not knowing my (unique-per-service, strong) passwords makes me nervous in exactly the same way as not actually knowing the phone numbers of the most important N people in my life.

You'll get over that little hurdle once you realize that you can dump the anxiety of remembering a hundred password variants for different sites. And realistically speaking, you're probably not even using a hundred variants...or possibly even 10. If you're memorizing passwords, chances are your re-use frequency is nonzero.

What's important is to keep a backup of your password database in a few places. I use KeePass because I have no desire to keep passwords, encrypted or not, in a cloud service. I also don't find value in browser integration (possible attack vector?). I'm generally very DIY-inclined anyway. Your preferences may vary.

Thanks, I'll check into KeePass.

And trade it for the anxiety of your manager getting pwned.

I guess you aren't familiar with KeePass. If your KeePass database is pwnd, that means your box has been pwnd since the database is stored locally and not any cloud provider (unless YOU put it there). This means you have much bigger problems and is not a shortcoming of KeePass, itself.

As a full disclaimer, there are some issues with KeePass [1], but known issues are detailed in full by the project and are available for review.

1. http://keepass.info/help/kb/sec_issues.html

A hardcopy backup is also wise

I'd image most shady spammers would know enough to filter out the +.