Security
Security at TempMail
A straight explanation of how we keep disposable email safe — describing only the protections that are actually in place.
Email content security
Every incoming message is cleaned on our servers before it is stored. We run the HTML through HTMLPurifier, which strips scripts, event handlers, and other active content, leaving only safe, readable markup.
Plain-text previews are generated with tags removed, so the summary you see in the inbox list can't smuggle anything executable.
How messages are displayed
When you open a message, its sanitized HTML is rendered inside a sandboxed iframe with scripting disabled. That means tracking pixels, embedded scripts, and auto-loading behaviors can't run or phone home from your browser.
Links open in a new tab and are never followed automatically, so simply reading a message doesn't trigger anything.
Inbox isolation
Each inbox is protected by a secret access token generated when the address is created and held only by the browser that made it. Reading or deleting an inbox's mail requires that token.
Requests with a wrong or missing token get the same "not found" response as a non-existent inbox, so the service never confirms whether a given address exists.
Data retention
Inboxes are short-lived: an address expires after a period of inactivity and stops receiving mail. Deleting an address, generating a new one, or letting a 10-minute inbox reach zero removes that address and its messages from our servers.
We store message content only to display it to you, and we don't store attachment files — only a flag noting a message had one. To remove an address and its mail right away, use the Delete button rather than just leaving.
Abuse prevention
Requests are rate-limited by IP so no one can flood the service with inbox or message requests. A set of reserved names (like admin, postmaster, and abuse) can't be claimed as custom addresses.
Inbound mail is accepted only from our verified mail pipeline via a shared secret, the contact form is protected by reCAPTCHA, and traffic is served over HTTPS so it's encrypted in transit.
Responsible use
TempMail is built for privacy, not anonymity, and not for harm. A disposable address hides your real inbox, but it isn't untraceable — like any site, connection data such as IP addresses exists.
Please don't use the service for spam, fraud, phishing, impersonation, or abuse of other platforms. See the Terms for the full list.
Reporting a security issue
Found a vulnerability or a way the service is being misused? Please tell us through the contact page and mention "security" so it's routed correctly. For how we handle the data behind all of this, read our Privacy Policy, and to understand where temp mail fits, see is temp mail safe.