How it works

There is no magic here, and knowing the mechanics helps you judge what the service is and is not good for.

The path a message takes

1. An address is generated for you. Ten random characters from a cryptographic random source, on one of our domains. The space is large enough that guessing a live address is impractical.
2. You paste it somewhere. No registration happens, because there is nothing to register. Our domains accept mail for any valid address, so yours works immediately.
3. A sender's mail server delivers to our domain. Standard SMTP, exactly as for any other address.
4. The message is parsed and stored. We extract the sender, subject, text and HTML parts, and any attachments, and write them to a database with an expiry timestamp attached.
5. Your open tab picks it up. The page polls for new mail every few seconds, so messages appear without a refresh.
6. Everything is deleted on schedule. A job runs continuously and removes messages, attachments included, once they pass their expiry.

Design decisions worth explaining

Receive-only, always

You cannot send from an address here, and that is not a missing feature. A free, anonymous service that sends mail becomes a spam relay within days, the domains get blocklisted, and then incoming mail stops arriving for everyone. Refusing to send is what keeps the service working.

Remote images blocked by default

Marketing mail is full of tracking pixels that report back when a message is opened. We strip remote images until you explicitly ask for them, so opening a message tells the sender nothing.

HTML is sanitized, then sandboxed

Email HTML is untrusted input. We run it through a strict allowlist that removes scripts, embedded frames, forms and event handlers, then render the result inside a sandboxed frame with a content security policy that blocks script execution outright. Two independent layers, so a gap in one is not enough on its own.

Plus addressing folds into one inbox

Mail to yourname+anything@ arrives in the yourname inbox. Handy when you want to tell several signups apart without juggling separate addresses.

No accounts, so no profile

We do not ask for a name, a password, or a recovery address, which means there is no user record to build on, breach, or hand over. Your address and its access token live in one cookie so the tab remembers them; only a hash of the token is stored here, so a database leak does not hand over live inboxes. That is the extent of it — see the privacy policy for the detail.

The limits that follow from this design

• A chosen address is public — anyone typing the same name reads the same inbox.
• A private inbox lives in one browser; clearing cookies loses it for good.
• Expiry is permanent; there is no recovery once mail is deleted.
• Some sites reject our domains, as is their right.
• Very large messages are refused at delivery time.

If those limits matter for your use case, read what temporary email does and does not protect before relying on it.