← All posts

A public inbox has no lock: what never to send to it

October 12, 2026 · 2 min read

A temporary inbox is convenient for one simple reason: there is no sign-up and no password. That convenience has a flip side. Anyone who enters the same address sees the same messages. There is no way to prove an inbox is "yours", because nothing ties it to you.

The account recovery problem

Most online accounts treat your email as the master key. Forget your password, and the site emails a reset link. Whoever can read that inbox can reset the password and take the account over. If that inbox is public, the account is only as safe as the name is hard to guess, and the name was never meant to be a secret.

Never use a temporary address for

• banking, payments, crypto wallets or shopping accounts with saved cards;
• work, school, government or health services;
• your main social media, cloud storage or email recovery address;
• anything where losing the account would hurt, or where the emails contain your home address, ID numbers or medical details.

Where a temporary address shines

• downloading a white paper or a free sample that is gated behind an email form;
• reading one article on a site that insists on an account;
• Wi-Fi portals at cafés and airports;
• previewing a newsletter before deciding whether your real inbox wants it;
• testing the emails your own website sends.

Small habits that help

• Use a random name. john or test are shared with every stranger who had the same idea. The names we generate are random and never handed out twice.
• Treat everything in it as public. If you would not pin it to a noticeboard, do not let it land there.
• Remember it expires. Messages here are removed after seven days. An account tied to the address cannot be recovered after that.