How our temporary inbox works
Every step, from the moment you open the page to the moment your inbox is deleted from our servers.
1. A quick bot check
Before we create an inbox, Cloudflare Turnstile checks in the background that you are a person and not a script. Most of the time you don’t need to click anything. This keeps people from creating thousands of inboxes for spam.
2. A random address and a private key
We create an address with 12 random letters and numbers before the @. You can’t choose the name, and that is on purpose: random addresses can’t be guessed, so nobody else can reuse yours or read its mail.
Your browser receives a secret access token along with the address and keeps it in local storage. That token, not the address, is what lets you read the inbox. We don’t put it in links, analytics, or logs.
3. Receiving mail
Email to our domains is received by Cloudflare Email Routing and handed to our worker. Before anything is stored, we check that the address exists, reject very large messages, and remove attachments. Mail for addresses that never existed, or that have already been deleted, is refused.
4. New mail on the page
While the page is open, it checks for new mail every 12 seconds. It pauses while the tab is in the background, and stops after 30 minutes without activity, to save battery and data. Press Refresh any time to check straight away.
5. Reading safely
Email from strangers can contain scripts, tracking images, and forms that imitate login pages. We parse each message in your browser, clean it, and display it in a sandboxed frame:
- Scripts never run.
- Remote images are blocked until you press Load images. Learn why in how email tracking pixels work.
- Links open in a new tab, separate from the inbox.
6. Cleanup
An inbox lasts 24 hours from creation. A cleanup job runs every hour and deletes expired addresses with all their messages, normally within a few hours of expiry. You can also delete a single message, or the whole inbox, at any time, which removes it immediately.
What we never do
- Send, reply to, or forward email from your address.
- Ask for your name, password, phone number, or real email.
- Use advertising or third-party analytics.