How TempMailer Works: Inbox Lifetime, Access, and Data Boundaries

TempMailer is a receiving-only, short-lived email tool. It creates an address, accepts mail for that address while it is active, and shows the parsed message to the browser that owns the mailbox session. It is not a permanent email account, an anonymity network, or a file-storage service.

This guide describes the current public behavior and the boundaries that matter when deciding whether TempMailer fits a task.

The lifecycle at a glance

generate address -> keep mailbox session -> receive message
-> read text or restricted HTML -> expire or destroy -> delete mailbox data

There are two user-facing lifetime modes:

• the standard temporary inbox uses a 24-hour default lifetime;
• the 10 Minute Mail mode requests a 600-second lifetime.

The interface shows the remaining time. When the task is finished, the user can destroy an address before its scheduled expiry. An expired address is no longer accepted as an active recipient.

1. Address creation

When a user asks for an inbox, the browser calls the TempMailer worker. The worker chooses an active receiving domain, generates or validates the local part, creates an expiry timestamp, and stores an address record.

Generation is rate-limited by session and network signals to reduce automated abuse. A generated address is not a user account and has no password. Access instead depends on the mailbox session established in the browser and, for shareable deep links, a signed, expiring link.

The browser keeps limited session state in local storage so it can restore the current address on the same device while the address remains active. Anyone who obtains a valid mailbox access link may be able to read that mailbox, so the link should be treated as a secret.

2. Receiving a message

Cloudflare Email Routing delivers incoming mail to an Email Worker. SMTP itself is defined by RFC 5321, but TempMailer’s application logic decides whether the destination is one of its active addresses.

Before parsing a message, the worker checks:

1. the recipient has a valid local part and an active TempMailer domain;
2. the address exists in the active-address database;
3. the address has not expired;
4. the sender is not covered by a temporary abuse-control block;
5. the raw message stays within the configured size limit.

Unknown and expired recipients are rejected instead of silently creating inboxes. This prevents arbitrary address guesses from becoming mailboxes and reduces the resources spent parsing unwanted mail.

3. What is stored

For accepted messages, the worker parses and stores the fields needed by the inbox interface:

• destination address and domain;
• envelope sender;
• subject;
• text body;
• HTML body;
• received time and original message size.

The current mailbox limit retains at most 50 recent messages for one address. The raw MIME message is read for parsing but is not stored as a raw-mail archive. Attachments are detected for operational statistics but are not stored or offered for download.

Message data is stored in Cloudflare D1 for the active mailbox. Scheduled cleanup runs every 30 minutes, with additional opportunistic cleanup during normal traffic. Expired address records and their inbox messages are removed; an extra age boundary also removes old inbox rows.

Deletion is not a promise that every infrastructure log everywhere disappears at the identical instant. Cloudflare and network systems may process limited operational or security data under their own policies. See the Privacy Policy for the disclosed categories and purposes.

4. Mailbox access control

The API checks whether a request has the mailbox owner’s session or a valid signed link. Signed links bind mailbox details to an expiry time and are verified using a server-side secret. The signature is compared without a simple early-exit string comparison.

This design is stronger than a public inbox that opens whenever someone guesses an address name. It is still not end-to-end encryption. TempMailer receives and parses ordinary email on the server, so it should never be used for highly sensitive documents, private keys, medical records, financial statements, or confidential recovery messages.

Do not publish a screenshot or URL containing mailbox access parameters. If another person needs a message, share the minimum information required rather than making the whole inbox link public.

5. Reading text and HTML

The inbox opens messages in text mode by default. This is sufficient for most verification codes and avoids automatically requesting sender-controlled images.

If the user chooses HTML view, the message is placed in a sandboxed iframe. A restrictive Content Security Policy blocks remote images, scripts, forms, media, external frames, and network-loaded fonts. Inline styling and embedded data images can still be displayed. The iframe also uses a no-referrer policy.

These controls reduce tracking and active-content risks while reading. They cannot guarantee that message text is honest, and they do not protect a user who intentionally opens an external link. Always verify the destination domain.

6. What TempMailer does not do

The service does not:

• send outbound mail;
• provide a permanent username or recovery account;
• guarantee delivery from every sender;
• bypass websites that prohibit disposable addresses;
• expose attachments for download;
• make a browser session anonymous;
• promise future access after an inbox expires;
• replace a secured mailbox for valuable accounts.

Sender systems may defer, reject, or suppress messages. Some websites do not send to known temporary domains. TempMailer cannot override those external policies.

7. Choosing the right mailbox

Task	TempMailer fit	Better alternative when needed
One-time low-risk verification	Good	—
Testing your own email flow	Good for a smoke test	Controlled SMTP sink for load tests
Short download confirmation	Good if no attachment is required	Durable inbox for files
Newsletter separation	Limited	Long-term forwarding alias
Paid account or saved work	Poor	Permanent secured inbox or durable alias
Banking, healthcare, legal, government	Not appropriate	Verified long-term inbox

The test is simple: if the message or account may matter after the mailbox expires, use a receiving address designed to last.

8. Privacy is a boundary, not a slogan

TempMailer reduces disclosure of a primary email address. The website you register with may still process IP addresses, cookies, browser characteristics, submitted names, payment information, and account behavior. Temporary email should therefore be described as address separation, not complete anonymity.

TempMailer also separates its own private mailbox routes from advertising and analytics. Dynamic mailbox pages are marked noindex, do not load Google Analytics or AdSense, do not publish canonical or hreflang links, and use a no-referrer policy.

Bottom line

TempMailer is designed for a narrow job: receive short-lived text messages without giving every website a permanent email address. It limits mailbox lifetime, rejects unknown recipients, controls access through session or signed links, deletes expired data, blocks remote content in HTML view, and avoids attachments. Those boundaries make it useful for low-risk verification and testing—and deliberately unsuitable for permanent or sensitive accounts.