Sign up for anything without giving your real address

What a disposable address actually is

Most mail services sell you a mailbox. This one has no mailboxes to sell. There is no account, no password and no create address button that reserves anything — you invent a name in front of one of the public domains and start using it. The mailbox comes into existence when the first message is delivered to it, and stops existing when the last message in it expires.

Three things follow from that, and between them they are the whole model:

Nothing to create

There is no sign-up step to get through before the address works. You can decide what it is while you are filling in the form that needs it, type it, and it will receive.

Nothing to lose

No password to forget and no account to be locked out of. The flip side is exactly as true: there is nothing that proves the mailbox is yours, because nothing was ever tied to you.

Nothing to keep

Every message is deleted 5 days after it arrives. That is a hard limit enforced by a job, not a setting you can raise.

Compared with the other two ways of not giving out your real address

Opening one, properly

1. Pick a name. Anything you like in front of grabmail.io, mixozia.com or the third public domain. Or take the random one the front page offers: eight characters from an alphabet that leaves out every pair people confuse — zero and capital O, one and lowercase L — so it survives being read off a screen and typed back in.
2. Paste it into the form. Nothing has to happen here first. The address does not need to exist before the mail is sent to it — the message is what makes it exist.
3. Open the inbox and wait. The mailbox page refreshes on its own; a verification mail normally lands in a couple of seconds. Take the code or the link, and walk away.

What the address may contain

Letters, digits, dot, dash, underscore and plus, one to sixty-four characters, starting and ending on a letter or a digit. That is deliberately stricter than the email standard allows: the same string ends up in a URL and in a lookup, and anything this refuses you can simply retype.

Give out the alias, not the address

This is the part worth the two minutes it takes to understand, because it fixes the one real weakness of a public disposable inbox.

On a public domain the address is the only thing standing between the mailbox and the world. So handing that address to a service means handing it the ability to come back later and read everything else that inbox was used for. Most disposable-mail services simply live with that.

Every mailbox here also has an alias: a second address, twelve characters long, that delivers into the same mailbox and says nothing about it. It is shown beside the address in the inbox, and returned beside it by the API.

So the habit is: put the alias in the form, and poll the address. The service you signed up to gets a working address that reaches you and is useless for reading anything. The alias is stable — the same mailbox always shows the same one — so you can hand it out today and still be using it in a month.

{
  "address": "k7fq2m@grabmail.io",
  "alias":   "qhx4tn8mrbzp@...",
  "count": 1,
  "messages": [ ... ]
}

It does not look like a throwaway address, and there is no alt. prefix or other tell on it. That is deliberate: a constant pattern is one regular expression away from being refused by the form you are trying to fill in.

What it is genuinely good for

• Trials and free tiers you want to look at once before deciding.
• Downloads behind an email wall — the whitepaper, the PDF, the coupon. Files arrive here too, up to 5 MB a message.
• Forums, wikis and one-off accounts you will not come back to.
• Wi-Fi captive portals and anything else that demands an address to let you through.
• Price alerts and stock notifications, which are useful for a week and noise for a year.
• Testing your own product — sign-up flows, password resets, digest mail. There is a whole guide to doing that from CI.
• Finding out who sold your address, if you give each service a different one. More on that below.

Where it stops working, honestly

Two more cases where this is the wrong tool, and neither is a criticism of the service:

Mail you will need later

Order confirmations, warranties, receipts, tickets, invoices. Everything here is deleted after 5 days, whether you read it or not, and there is no export and no undo.

Anything confidential

Do not send or receive anything you would mind a stranger reading. That is not a warning about us reading it — it is that the address is the only secret involved, and secrets that short get guessed.

And one that catches people out: you cannot reply. Nothing here sends mail, by design — it is what keeps a free service with no accounts from becoming a spam relay. If the exchange needs a reply from you, this is not the tool.

When a form refuses the address

Plenty of sites keep lists of known disposable-mail domains and reject them at sign-up. It is a reasonable thing for them to do, and it is worth knowing what your options actually are rather than fighting it blindly.

The durable fix is pointing a domain you own at us. It costs one DNS record, the domain never appears anywhere on this site, and no blocklist has heard of it. Every address on it works from the first message.

If it needs to be private, be precise about what that means

“Private” gets used for two completely different things, and mixing them up is how people end up disappointed.

Private from the sender

They never learn your real address. A disposable inbox does this completely, and the alias does it even better.

Private from everyone else

Nobody but you can read the mailbox. A disposable inbox does not do this, on a public domain or on your own: there is no account, so there is nothing a mailbox could be locked to.

What a domain of your own changes is not the lock — it is the guessing. The public domains are printed on every page of this site, so somebody trying names against them will eventually land on a live mailbox. Nobody is trying names against a domain they have never heard of. That is obscurity rather than access control, and it is worth having as long as you know which of the two you are getting.

There is a third kind of privacy that has nothing to do with either: what the sender learns once the message is in front of you. Remote images are blocked here for that reason, and the guide to tracking pixels explains what one request would have told them.

Five habits that make this work

1. Make the address unguessable. Eight random characters cost you nothing and take the mailbox out of the space anyone would try.
2. Hand out the alias. One extra click, and the service can never read the inbox it was given.
3. One address per service. Free, and it tells you later who leaked it.
4. Take what you came for immediately. The code, the link, the file. Assume the message will not be there tomorrow — after 5 days it definitely will not be.
5. Delete it when you are done. Not required, since everything expires anyway, but it is one click and it closes the window early.

Do those five and a disposable inbox stops being a trick and becomes an ordinary part of how you sign up for things.

Questions