Frequently Asked Questions

A temporary email address is a real, working inbox that you use for a short time and then abandon. It receives mail like any normal address, so you can grab a verification code or confirmation link, but you never have to connect it to your identity or your primary inbox. When you are done, you simply walk away — no cleanup, no lingering account, no marketing list following you around for years.

You generate an address on the spot (or pick a username on one of our domains), hand it to whatever site is demanding an email, and watch messages arrive in real time in your browser. Behind the scenes it is a genuine mail server accepting SMTP on our domains and delivering to a live mailbox — not a fake preview. Paid plans let you keep addresses permanently, use your own domain, and pull mail programmatically over the API.

No. The core temp-mail flow works instantly in any browser with no account and no download. You create an account only if you want the extras — persistent mailboxes, custom domains, API keys, or higher limits. There is also a browser extension and mobile app if you prefer, but they are optional conveniences, not requirements.

The disposable inbox on our free domains is free to use. Paid plans add the things power users and developers need: custom domains, unlimited or high per-domain mailbox counts, permanent addresses, higher API rate limits, and premium domain choices that services are less likely to block. You can see exactly what each tier includes on the pricing page.

On the free flow, a session-based address lives for a configurable window — from about 10 minutes up to 24 hours — which is plenty for a one-time verification. If you own the domain or hold a paid plan, you can create addresses that never expire and manage them like a normal mailbox.

For its intended purpose — signups, trials, downloads, forum registrations, and one-off verifications — yes. It keeps your real address out of marketing databases and reduces your exposure when a service inevitably gets breached. What it is not built for is anything you actually need to keep: banking, government portals, primary social accounts, or anything tied to account recovery. Treat a burner like a burner.

Addresses you create under your own account (paid plans, custom domains) are private to you and protected by your login and API key. Randomly generated public addresses on shared free domains should be treated as low-security by design — if someone guessed the exact address, they could see what arrives. Never route a password reset for an important account through a public throwaway inbox.

No. The business model is subscriptions, not surveillance. We do not sell contact data or email content to advertisers or brokers. We keep only what is needed to run the service and prevent abuse, and message content in temporary inboxes is retained only for the life of the session or mailbox.

For anonymous temp-mail use, essentially just an IP address for rate limiting and abuse prevention, which ages out with the session. If you create an account we store your username and, optionally, a contact email; payment details are handled by our payment processor and never touch our servers. Full specifics live in the Privacy Policy.

It stops a lot of it. Because you give a unique throwaway address to each service, you break the cross-site linking that data brokers rely on, and any spam that follows dies with the address. For an even tighter setup, pair per-service addresses on your own domain with an email client that blocks remote images — that shuts down the invisible tracking pixels most marketing mail carries.

Yes, on paid plans. You point a few DNS records (MX plus SPF, DKIM, and DMARC for good deliverability) at our mail servers, verify ownership, and then create as many addresses on your domain as your plan allows. This gives you addresses that look professional and are far less likely to be blocked than well-known disposable domains.

Yes. The REST API lets you create mailboxes, list and read messages, extract verification codes, and manage domains and DNS programmatically using an API key. It is designed for automated testing, CI pipelines, and any workflow that needs disposable inboxes at scale. The API reference documents every endpoint with live examples.

That is one of the most popular uses. Instead of cluttering a shared Gmail account or mocking everything, your test suite can spin up a fresh mailbox, trigger a signup or password-reset flow, poll the inbox over the API, pull the one-time code straight out of the message, and assert on it — end to end, in seconds, with no human in the loop.

Read the message through the API and parse the code from the subject or body with a small regex, or use the regex-extraction endpoints tuned for common providers. For automated flows, poll the inbox on a short interval (or use the account activity stream) until the message lands, then extract and continue. Our developer guides walk through the full pattern with code.

Some sites maintain blocklists of known disposable domains, which is exactly why paid plans offer premium domains and full custom-domain support. An address on your own domain is indistinguishable from any other business mailbox, so it sails through validation that would reject a generic throwaway.

More domains, more mailboxes per domain, permanent (non-expiring) addresses, higher API rate limits, premium domain choices, and priority support. The exact numbers scale by tier — the pricing page lays out each plan side by side so you can match it to your use case.

We accept credit and debit cards through Stripe, handled entirely on Stripe’s secure, PCI-compliant checkout — your card details never touch our servers. Cryptocurrency payment is also available for those who prefer it. Your subscription activates automatically as soon as payment is confirmed.

Yes. You manage your subscription from your dashboard, where you can upgrade, downgrade, or let a plan lapse. Upgrades take effect immediately; when a paid plan ends, your account simply returns to free-tier limits.

Addresses on our system domains fall back to free-tier behavior. Addresses on a custom domain you own stay yours — the domain and its DNS belong to you — though the per-mailbox and API limits revert to the free tier until you renew. Nothing is deleted out from under you without warning.

First give it a moment — mail delivery is near-instant but not always literally instant, especially if the sender queues messages. Confirm you typed the exact address the sender used, check that the sending service did not silently reject a disposable domain, and refresh the inbox. If you are on the API, make sure you are polling the right mailbox and account.

That service is filtering known disposable domains. Switch to a premium domain (paid plans) or, better, an address on your own custom domain, which will not be recognized as disposable. If you only need to receive one message, trying a different one of our domains sometimes works too.

EvilMail is built for receiving. Disposable and temp-mail services generally restrict or disable outbound sending to prevent spam and abuse — which also protects the reputation of the domains everyone shares. If you need to send from your own domain, use a dedicated sending provider alongside your custom-domain inboxes.

Open the message in your inbox view to see the rendered HTML, images, and clickable links exactly as the sender intended. Links open in a new tab. If you are automating, the API returns both the HTML and plain-text versions so you can parse whichever is cleaner for your use case.

The contact page has a form that reaches support directly, and paid plans include priority handling. If you are a developer, the API reference and the blog cover most integration questions in depth with worked examples.