mail.tm alternative: GrabMail vs mail.tm

At a glance

Fourteen rows. Every mail.tm cell is what its home page, FAQ, privacy page and documentation said on 2 September 2026; every GrabMail cell is read from the constants the service enforces. “Partly” means a caveat the row cannot hold — the sections below say which.

Checked 2 September 2026. mail.tm’s domain endpoint listed exactly one active public domain on that day, which its FAQ says is always renewed; the number can change. Its documentation counts a token as “no API key”; the table counts a token a pipeline must store as a secret, and says so.

What mail.tm does well

mail.tm is the service a great many scripts, bots and libraries were written against, and for good reasons. Four things it does that GrabMail does not:

• Private mailboxes. Each one gets a generated password, stored encrypted, that even mail.tm cannot reset. A verification code sent to a mail.tm address is readable by the holder of the token and nobody else. Every GrabMail mailbox is public, and the alias is the workaround.
• Push instead of polling. Subscribe to /accounts/{id} on its Mercure hub and new messages arrive as server-sent events. A script that would otherwise sleep and poll can wait on a stream. GrabMail has no push; its MCP wait is the nearest thing, and only for agents.
• Seven days, and a mailbox that stays. Messages live seven days against 5 here, and the mailbox itself lives until you delete it.
• An ecosystem. Community libraries in .NET, Dart, Go, Java, JavaScript, PHP, Python, Rust and Swift, an llms.txt and Markdown twins of every docs page. GrabMail has an OpenAPI document and guides, and no libraries.

Where GrabMail is different

GrabMail removes the two steps mail.tm still has — the account and the token — and adds the three things mail.tm does not offer: a domain of your own, an MCP server, and a page without ads.

• No account, no token. On mail.tm a mailbox is an account you create with a password, exchange for a bearer token, and store. On GrabMail GET /api/v1/mailbox?address=… is the whole call. A CI job on a fork, a public gist and an unattended agent have nothing to keep.
• Your own domain, free. mail.tm publishes nothing about bringing a domain; on the day of checking it listed one public domain, which every blocklist knows. Here any domain you point at smtp.grabmail.io is a catch-all inbox, unlimited and free — the durable answer to forms that refuse disposable domains.
• An MCP server. mail.tm has none of its own; third parties wrap its API. GrabMail’s at https://grabmail.io/mcp gives an agent create_inbox, a blocking wait_for_message of up to 25 seconds and read_message, with nothing to sign up for.
• No ads, and limits in writing. No Freestar, no ad-blocker plea, no analytics. 5 MB per message, one read a second per address, 5 days: all on the limits page. mail.tm publishes its 8-requests-a-second limit too; it does not publish an attachment size.

Price, side by side

There is nothing to price at mail.tm: no paid tier, no paid extras, ads on the site. GrabMail’s only paid plan buys access to a pool of domains kept off the disposable-mail blocklists; everything in the table above stays free.

As published on 2 September 2026. GrabMail’s pricing page has the full grid.

For developers: reading a mailbox

The whole difference in one command. This reads a GrabMail mailbox with no header, no token and no account:

$ curl -sG https://grabmail.io/api/v1/mailbox --data-urlencode "address=anything@grabmail.io" | jq '{count, alias}'

The mail.tm equivalent is four calls: GET /domains for an available domain, POST /accounts with an address and a password, POST /token, then GET /messages with Authorization: Bearer. It is well documented and there is a library for it in your language. It is also a secret you now hold and a rate of 8 requests a second per IP you now share across every mailbox you poll. GrabMail’s reference is three endpoints and the limit is per address; the Python and Node.js guides have the wait loop.

If you stay on mail.tm, use the SSE stream instead of polling; that is what it is for and it is the thing GrabMail cannot give you. If you move, the address is the only state: nothing to create, nothing to store, nothing to delete when the test ends.

For AI agents

mail.tm runs no MCP server of its own, though third-party wrappers exist and its llms.txt helps a model read the docs; an agent using it directly has to create an account, keep a token and manage a stream. GrabMail’s server at https://grabmail.io/mcp gives an agent an inbox with no key: create_inbox, a blocking wait_for_message of up to 25 seconds, read_message.

Email for AI agents covers the four-call loop and the guard rails; the client guide has the configuration for Claude, Cursor and five others.

Switching from mail.tm

A script moves in an hour; a workflow built on the SSE stream should think first. The steps:

1. Delete the account dance. Remove /domains, /accounts and /token; an address on grabmail.io, mixozia.com, another of the 8 public domains, or your own domain is an inbox with nothing created.
2. Replace the bearer read with a keyless GET. GET /messages with a token becomes GET grabmail.io/api/v1/mailbox?address=…; a message is one more GET. Page with the next cursor.
3. Replace the stream with a loop or a wait. Poll once a second with a deadline, or use the MCP wait_for_message from an agent. If the stream is load-bearing, stay.
4. Rethink privacy. Your mail.tm mailbox was private; a GrabMail mailbox is public. Hand out the alias where it matters, and never send anything you would mind a stranger reading.

Which one, for what

The honest split:

When to stay with mail.tm

Three situations where switching would cost you something real:

• The mailbox must be private. mail.tm’s password-per-mailbox is a real privacy property; GrabMail has none. A code that must not be readable by anyone else belongs on mail.tm.
• You built on the stream. Server-sent events are the right model for a long-running bot, and GrabMail will not add push.
• Your library does the work. If a community client handles accounts, tokens and streams for you, the switch buys you a simpler API at the price of code you did not have to write.

Questions