What is a temporary e-mail address for testing?
A temporary inbox is a real, receivable e-mail address that exists for a short time so a tester can complete sign-up, verification and notification flows without using a personal mailbox or a shared team account. It lets you see what the application actually delivered — the sender, subject, body text and links, and when it arrived — which is what you need to test OTP delivery, password resets and transactional templates. The inbox on this site does not show raw headers, and it renders HTML only on request, sanitised and with remote images blocked.
How to use Temporary Email
- Open the tool. A temporary address is generated for you immediately.
- Press Copy Email and paste the address wherever you need it.
- Leave the page open. Messages appear in the inbox below; press Refresh Inbox to check immediately.
- Press Open on a message to read it. Use Show HTML version if the plain text is not enough.
- Press New Email at any time to discard the current address and start again with a clean inbox.
| # | From | To | Event or condition |
|---|---|---|---|
| 1 | Address issuedStart | Active | The page opens (or New Email is pressed) |
| 2 | Active | Active | Every ten minutes while the page is open in a visible tab, the browser renews it, whether or not you are doing anything |
| 3 | Active | Not renewed | Tab closed or left in the background: renewal stops |
| 4 | Not renewed | Deleted with every messageEnd | About thirty minutes without renewal |
| 5 | Active | Deleted with every messageEnd | You leave the page: it asks for immediate deletionalternative path |
| 6 | Active | Deleted with every messageEnd | 24 hours after it was issued, no matter whatalternative path |
| 7 | Active | Address issuedStart | New Email: the current address and its messages are deleted, and a fresh address is issuedalternative path |
Deletion is final and nothing is archived, so copy out anything you need before you leave.
Temporary Email features
- A random address issued the moment the page opens — no account, no form, nothing to configure
- Inbox on the same page: messages appear below the address, with no second screen to visit
- The address stays alive while you are using it and is released automatically once you stop
- New Email retires the current address and its messages outright and issues a fresh one
- Plain text shown by default; the HTML version is opt-in and keeps the message's own colours and layout inside an isolated, script-free frame
- Remote images are blocked unless you choose Show images for a message, so opening one does not confirm to the sender that it was read
Temporary Email example
Signing up for a newsletter without handing over your real address
Input:
1. Copy the generated address, e.g. k7r2mfqd8xbtn4hvzcpw@example-inbox.test
2. Paste it into the newsletter signup form
3. Wait on this pageOutput:
From: no-reply@newsletter.example
Subject: Confirm your subscription
Received: 14:07
Click the link below to confirm... [Open]Frequently asked questions about Temporary Email
How long does the address stay active?
It stays alive while the page is open in a visible tab: the browser quietly renews it every ten minutes, whether or not you are doing anything, so it will not expire mid-task. Once renewal stops, because the tab is closed or left in the background, the address lapses within about thirty minutes (leaving the page also asks for immediate deletion), and there is a hard ceiling of 24 hours no matter what. When it lapses the address and every message in it are deleted.
Can I get my messages back after the address expires?
No. Expiry deletes the mailbox and its contents outright, and nothing is archived. That is the point of a temporary address — if you need to keep something, copy it out before you leave.
Is this private?
It is disposable, which is not the same thing. Messages sit on the Mutqan backend while the address is alive, and anyone who obtains the address could in principle send to it. Treat it as a public inbox: use it to avoid handing out your real address, never for anything confidential.
Why are some images in a message not shown?
Images from other servers are blocked by default. Loading one tells the sender that the address is live and the message was read, which defeats the reason for using a disposable address in the first place. Pictures embedded in the message itself and this site's own logo are shown, along with the message's colours, fonts and layout. To load the remote images of one message, press Show images: they load for that message only, and loading them can tell the sender that you opened it. Images sent over plain http, SVG images and embedded pictures that are too large are never shown.
Can I reply to a message, or send from this address?
No. The mailbox only receives. It is built for one-way traffic such as confirmation links and verification codes, and adding a send path would turn it into an anonymous relay, which is not something this site offers.
What happens to attachments?
They are reported so you know a message had them, but they are not stored and there is nothing to download. Keeping arbitrary files from anonymous senders is a risk with no matching benefit for a throwaway inbox. The one exception is a small picture the message displays inside itself, such as a logo or a signature: it is kept as part of the message and deleted with it.
Technical notes
The address and the credential are separate things. The address is public by necessity — it has to be given out — so it is never accepted as authorization. Creation returns a bearer token of which only an HMAC is stored, and every inbox read resolves that token to a live mailbox. A request carrying the address instead of the token is refused exactly like a request carrying nothing.
Lifetime is a server-side lease, not a browser timer. The page renews the lease while it is open in a visible tab, which is what stops the address expiring mid-task, and a separate absolute ceiling stops a forgotten tab from holding an address indefinitely. Expiry is enforced when the mailbox is read, so a lapsed address stops working immediately rather than at the next cleanup pass.
Inbound HTML is sanitized on arrival with an allow-list over a real HTML parser — styles pass a strict CSS allow-list that refuses external resources and positioning — and stored already clean, so nothing unsafe is ever at rest. The browser then renders it inside a sandboxed frame with no script permission and a content policy that blocks every network request except embedded images and this site's own assets; remote images are fetched only for a message where you press Show images. Two independent layers, neither trusted on its own.
References
- RFC 5322: Internet Message FormatThe syntax of e-mail messages and addresses (local-part@domain) that validators are measured against.
- RFC 2606: Reserved Top Level DNS NamesReserves example.com, example.net, example.org and .test/.example for documentation and testing — the domains to use in fake data.