Frequently asked questions

Everything about how Mailfume works, in plain language.

What is Mailfume?

Mailfume gives you a random, disposable email address the instant you load the page. There's no signup, no password, and no personal information involved. You use the address to receive mail — for a signup form, a download gate, a forum registration, whatever — and when you're done, you let it expire or start a new one.

How long does an address last?

By default, an inbox lives for 60 minutes from the moment it's created. A countdown and a draining bar on the page show you exactly how much time is left. If you need more time, click Extend before it runs out. When the timer hits zero, a background process permanently deletes the inbox, every message in it, and the raw files on disk. There's no way to recover it afterward — that's by design, not a bug.

Can I send email from my Mailfume address?

No. Mailfume is receive-only. It has no outbound mail path at all — there's no compose button, no reply button, no SMTP relay behind it. This is intentional: a receive-only service can't be used to send spam, phishing mail, or abuse from its addresses, which is a big part of why disposable mail providers get blocked or blacklisted. Mailfume avoids that problem by simply not sending anything, ever.

Is my inbox private? Can someone else read it?

Each inbox is tied to a private session token that's generated in your browser and stored in your device's local storage. That token is required to view the inbox's messages — there is no page or endpoint that lets someone browse to an arbitrary address and read its mail. Even if a sender knows your address, they can't view what's inside; only the browser holding the matching token can. Close the tab and clear your storage, and that access is gone too.

Why can't I pick my own address?

In this version, every address is generated randomly (something like jolly.comet50@…) rather than chosen by you. That trade-off is deliberate. A custom, human-picked address is easy to guess or re-derive — if you could type in "john.smith@" it wouldn't take much effort for someone else to type the same thing and land in the same inbox. Random addresses close that hole. We may revisit custom addresses later with proper access controls, but for now, random-only keeps every inbox private by construction.

Does new mail show up automatically?

Yes. The page holds a live streaming connection to the server, so new messages typically appear in your inbox within about two seconds of arriving — no refresh button, no polling delay you'll notice.

Can I receive attachments?

Yes. If an incoming message has attachments, they show up in the message viewer and you can download them individually. Nothing runs automatically — you choose what to open.

Is it safe to open HTML emails here?

Yes, by design. Incoming HTML mail is sanitized on the server before it ever reaches your browser, and it's then rendered inside a locked-down sandboxed frame that cannot execute scripts or make network requests. You can read a marketing email's design without it being able to run tracking or exploit code against you.

A site rejected my Mailfume address — why?

Some services actively block known disposable-email domains, because letting people bypass verification is a problem for them too. There's no way around this from our side — if a signup form rejects the domain, you'll need a different address for that particular service. It's a normal, expected limitation of using disposable mail anywhere verification matters long-term.

I lost my tab — can I get my address and messages back?

No. Because access depends entirely on the session token stored in that browser tab's local storage, closing the tab, clearing site data, or switching browsers/devices means the token is gone and so is any way to reopen that inbox. Even if the inbox hasn't expired yet on the server, there's no recovery path without the token. Treat every Mailfume address as fully disposable — don't rely on getting back to it later.

Can I use this for password resets or account recovery?

You can receive the reset email, but you should not use a disposable address as the recovery email for anything you actually care about keeping. Once the inbox expires — 60 minutes later by default — that address and every message in it are gone permanently, including any future password-reset or login links sent to it. Use Mailfume for one-off verification, not for accounts you plan to keep.

Is there a limit on how many addresses I can create?

Yes. To keep the service usable for everyone and to prevent automated abuse, inbox creation is rate-limited per IP address, currently around 30 new inboxes per hour. If a message arrives addressed to something that was never created (or has already expired), it's simply dropped rather than stored — there's no mailbox waiting for it.

Have a question that isn't answered here? The behavior described above reflects exactly how the service works today.