Behind the simple inbox on our homepage there is a complete mail system. Here is what happens from the moment you open the page until your address expires.
1. An address and a private key are created
When you arrive, the server generates a random address on one of our mail domains and a separate 256-bit access key. The key is stored in a secure, HttpOnly cookie that only your browser holds; the server keeps just a one-way hash of it. Possessing that key — not knowing the address — is what gives you access to the inbox.
2. Someone sends you an email
The sender's mail server looks up the MX record of our domain and connects to our receiving server. During that conversation our server checks whether the recipient address is active. Mail for unknown or expired addresses is refused straight away, so nothing is stored for addresses nobody owns.
3. The message is processed safely
Accepted messages are written to a durable queue and parsed: the subject and sender are decoded, plain-text and HTML versions are separated, and attachments are checked against size and file-type rules. HTML is cleaned of scripts, forms and hidden tracking images, and the result is encrypted before it is saved.
4. Your inbox updates automatically
The page checks for new mail every few seconds using a very small request. When something arrives you see it in the list, with a notification if you allowed one. Opening a message displays it inside an isolated frame that cannot run scripts, and remote images stay blocked until you choose to load them.
5. Everything expires
Each address has a lifetime you choose — from minutes to a day — that is enforced on the server. You may extend it a limited number of times. When the time is up, the inbox stops accepting mail, the access key stops working, and an automatic cleanup job permanently deletes the messages and attachments. Addresses are never handed out again to another visitor.