How TempMails Protects Your Temporary Inbox — and Its Limits

What 'private by design' means here

The phrase does not mean invisible, anonymous, or appropriate for secrets. It means the product starts with safer defaults: no account is required for a guest inbox, a random secret controls inbox access, message previews avoid remote tracking images, optional member data is disclosed, and every mailbox has a deletion deadline.

Privacy claims should be specific enough to verify. The sections below explain what TempMails does, what data still exists while the service operates, and where users must make their own risk decision.

1. A unique token protects each mailbox

• When a mailbox is created, the API generates a cryptographically random access token and returns it once to the browser.
• The server stores a SHA-256 hash of that token rather than the original token.
• Reading, extending, or deleting the mailbox requires the token in a dedicated request header.
• Email queries use an exact normalized address match, preventing wildcard-style access to neighboring inboxes.

2. The address and the access secret are different

A sender necessarily knows the email address, but knowing the address alone is not enough to open its TempMails inbox. This is stronger than disposable services where typing an inbox name reveals its messages. The browser keeps the token for the active session so refreshes do not require an account password.

Anyone who obtains the token can still access that mailbox until deletion or expiry. Do not share browser storage, screenshots containing sensitive session data, or access to an unlocked device.

3. Message previews reduce tracking exposure

• Plain text is preferred when a message provides it.
• HTML is sanitized before rendering, and scripts, forms, frames, embedded objects, remote images, media, inline styles, and remote source attributes are blocked.
• The SMTP receiver applies an attachment-size limit so unexpectedly large files are not placed directly into the inbox payload.
• Receive-only operation reduces opportunities for the service to be abused as an outbound spam system.

4. You control the exposure window

A guest inbox lasts 10 minutes. Verified Google members can choose 10, 20, 30, 40, 50, or 60 minutes. The countdown shows the server expiry, and users can delete the mailbox immediately. Expired or deleted recipients are rejected by the SMTP receiver, while scheduled cleanup removes expired mailbox records and messages.

A short timer is not automatically better for every task. Ten minutes reduces retention for a quick code; a longer member timer is more practical when a legitimate sender is delayed. Choose the shortest period that still lets you finish the task.

5. What TempMails cannot guarantee

• It does not make you anonymous to websites, network providers, email senders, or service infrastructure.
• It cannot guarantee when an outside sender will deliver a message or whether a website accepts disposable domains.
• It cannot recover an expired mailbox or make a temporary address suitable for account recovery.
• It is not appropriate for banking, healthcare, government, employment, purchases, private documents, or important accounts.
• Operational logs, hosting controls, legal requirements, and any configured infrastructure backups must be covered accurately by the published privacy policy.

How we keep this page accountable

We update this explanation when the implementation changes, show a visible modification date, identify the maintainer, and link our editorial process. AI may assist research and structure, but feature claims are checked against the running product and source before publication.