What does BCC mean in email? BCC vs CC explained

BCC means "blind carbon copy." It sends someone a copy of an email while hiding their address from the people in To and CC. In Gmail and Outlook, BCC recipients also cannot see the other BCC recipients.

It is useful for a one-off note to people who should not see one another's addresses. For example, you could send a building maintenance notice to several tenants without sharing their email addresses. Everyone gets the notice; each tenant can reply to you privately.

BCC vs CC: key difference

Field	Who sees the address?	When to use it
`To`	Everyone receiving the message	The main person or people you are addressing
`CC`	Everyone receiving the message	People who should be visibly included in the conversation
`BCC`	The sender; hidden from other recipients in Gmail and Outlook	People who need a copy without sharing their addresses

Suppose you email a customer about an appointment. Put the customer in To and a colleague arranging the appointment in CC: both should know who is involved. If you send the same closure notice to several unrelated customers, put their addresses in BCC and your own address in To.

Your own address in To is a convenient way to address a group notice. It does not control replies. Replies normally go to the message's Reply-To address, or its From address when no Reply-To is set, as described in the email message standard.

How to add BCC in Gmail and Outlook

Check the complete recipient list before sending, especially when autocomplete offers several people with similar names. Moving an address into BCC will not remove a second copy accidentally left in To or CC.

Gmail on a computer

Open Gmail and choose Compose.
Click Bcc beside the recipient area to reveal the field.
Put the private recipients in Bcc. Add any visible recipients in To or Cc.
Write the message, check the addresses, then choose Send.

Google's sending instructions describe the recipient fields and their visibility. A Gmail recipient who was BCC'd can see that they received a blind copy, but cannot see anyone else in BCC.

Outlook for Windows

In new Outlook, open the message and choose Options > Show fields > Show Bcc. In classic Outlook, open a new message in its own window and choose Options > Bcc; when replying in the Reading Pane, use Bcc on the ribbon. Add the private recipients to that field before sending.

To review a message you sent, open it in Sent Items and expand its recipient details if necessary. Microsoft's BCC instructions explain that the sender can see the BCC names in the sent message, while recipients cannot inspect the original hidden list.

What happens when someone replies?

Reply normally sends a response to the sender or the specified Reply-To address. A BCC recipient can use it to answer privately without adding the visible recipients.

Reply All normally includes the sender and the visible To and CC recipients. It does not recover the hidden BCC list. If a BCC recipient chooses Reply All, their own address becomes visible to the people receiving that reply. Other hidden recipients remain hidden.

A person in BCC also does not automatically receive later replies from the visible recipients. They received the original copy, not membership in every subsequent conversation. Check the outgoing recipient fields before replying, since clients and custom reply settings can differ.

When to use BCC

Use BCC for a small, one-time update when the recipients do not need to talk to one another. A service notice to customers or a schedule change sent to unrelated suppliers fits this pattern. Use a monitored sender or reply address so questions reach someone who can answer.

A documented archive copy is another use. If your organization requires one, make it part of the sending configuration and test that it arrives. An informal BCC habit is easy to miss when someone sends from another app.

Use CC when people need to collaborate openly. If a colleague only needs background, forwarding the message with a short explanation can be clearer than quietly adding them to an active conversation. Before a group notice, check that unrelated recipients appear only in BCC and that the body or attachment does not disclose their addresses separately.

For newsletters and recurring promotions, use a campaign workflow that sends an individual message to each subscriber and manages unsubscribe requests, suppression and bounces. A contact group merely saves you entering addresses; it does not by itself provide those controls. BCC recipients also count toward your provider's sending limits.

What BCC keeps private

Email delivery uses an SMTP envelope to tell servers where to send the message. The To, CC and other headers belong to the message recipients can read. BCC uses that separation to deliver a copy without putting the private address in the copies sent to visible recipients.

The standard allows different BCC implementations, including removing the field, leaving it empty, or sending separate copies to BCC recipients. Gmail and Outlook's documented behavior should not be assumed for every custom mail library. Check your own sending path when privacy depends on it.

BCC is not encryption. The sender and systems processing the delivery may retain recipient information, and a recipient can forward the message or disclose their own participation.

How to test BCC before a real send

For an application or shared sending workflow, test with addresses you control before using customer addresses. Checking the outgoing payload alone misses mistakes made later when the message is assembled or relayed. You need to compare the copies that actually arrive.

MailSlurp is an email testing platform with inboxes you can create and inspect by API. Separate inboxes for visible and hidden recipients let you repeat this check without sorting through personal mailboxes.

For a manual test, use one sender, one To recipient, one CC recipient and two BCC recipients. Send a harmless message with no real customer data, then check that:

All four recipient inboxes receive it.
Neither visible recipient's copy contains either BCC address.
Each BCC copy keeps the other BCC address hidden.
Reply and Reply All show the expected recipients before you send a response.

Two BCC inboxes let you check privacy between hidden recipients as well as privacy from the visible ones. If you only test one hidden recipient, you have not checked that distinction.

BCC in SMTP and email APIs

The following TypeScript example performs the delivery and address checks with MailSlurp's sending API. It creates fresh inboxes, matches a unique subject and attempts to delete every inbox it created, even if setup or an assertion fails. It sends once and does not automatically retry a failed send.

Install Node.js 20 or later, set MAILSLURP_API_KEY in your environment, and create a directory for the example:

npm init -y
npm install mailslurp-client@17.4.0
npm install --save-dev tsx typescript @types/node

Save this as bcc-test.ts:

import assert from "node:assert/strict";
import { randomUUID } from "node:crypto";
import {
  MailSlurp,
  MatchOptionFieldEnum,
  MatchOptionShouldEnum,
} from "mailslurp-client";

async function main(): Promise<void> {
  const apiKey = process.env.MAILSLURP_API_KEY;
  assert.ok(apiKey, "Set MAILSLURP_API_KEY before running this test");
  const mailslurp = new MailSlurp({ apiKey });
  const inboxIds: string[] = [];
  const failures: unknown[] = [];

  async function createInbox() {
    const inbox = await mailslurp.createInbox();
    inboxIds.push(inbox.id);
    return inbox;
  }

  try {
    const sender = await createInbox();
    const to = await createInbox();
    const cc = await createInbox();
    const bccA = await createInbox();
    const bccB = await createInbox();
    const subject = `BCC visibility ${randomUUID()}`;
    const hidden = [bccA.emailAddress, bccB.emailAddress];

    await mailslurp.sendEmail(sender.id, {
      to: [to.emailAddress],
      cc: [cc.emailAddress],
      bcc: hidden,
      subject,
      body: "A test of recipient delivery and address visibility.",
    });

    for (const recipient of [to, cc, bccA, bccB]) {
      const [email] = await mailslurp.waitForMatchingEmails(
        {
          matches: [{
            field: MatchOptionFieldEnum.SUBJECT,
            should: MatchOptionShouldEnum.EQUAL,
            value: subject,
          }],
        },
        1,
        recipient.id,
        30_000,
        false,
      );
      assert.ok(email, "Expected the test email to arrive");
      assert.equal(email.subject, subject);
      assert.equal(email.from?.toLowerCase(), sender.emailAddress.toLowerCase());

      const raw = (await mailslurp.getRawEmail(email.id)).toLowerCase();
      for (const address of hidden) {
        if (address !== recipient.emailAddress) {
          assert.ok(!raw.includes(address.toLowerCase()), "BCC address leaked");
        }
      }
    }
  } catch (error) {
    failures.push(error);
  } finally {
    const cleanup = await Promise.allSettled(
      inboxIds.map((id) => mailslurp.deleteInbox(id)),
    );
    cleanup.forEach((result, index) => {
      if (result.status === "rejected") {
        failures.push(new Error(`Could not delete inbox ${inboxIds[index]}`, {
          cause: result.reason,
        }));
      }
    });
  }

  if (failures.length) {
    throw new AggregateError(failures, "BCC test or inbox cleanup failed");
  }
  console.log("All recipients received the test; BCC visibility checks passed.");
}

main().catch((error: unknown) => {
  console.error(error);
  process.exitCode = 1;
});

Run it with npx tsx bcc-test.ts. A successful run confirms that the uniquely identified message reached all four test recipients and that the inspected raw copies did not contain the other hidden addresses. Cleanup failures cause a nonzero exit too; the error identifies the inbox to remove manually.

This tests MailSlurp's sending path. To check your application, send through its actual SMTP client or email provider to the same test inboxes, then apply the receipt and raw-message checks. The BCC and CC SMTP guide explains that separation. Keep the manual Reply All check for the clients your team uses; the script does not open a mail client or test replies.

Build with MailSlurp

Connect & learn

BCC in Email: Meaning, Examples, and Uses