About TempMailGrab

TempMailGrab is a privacy-first disposable email service for quick verifications, OTP codes, and developer email testing. It is newer than the biggest temp-mail brands, so the site is built around explicit proof: retention, security, status, API docs, and public research.

Why We Built TempMailGrab

The problem is simple: every sign-up form on the internet asks for your email address. Most of the time, what the site actually needs is just proof that you control an inbox — to send one verification code and confirm you are a real person. But what they get to keep, indefinitely, is your real email address: stored in databases you have no visibility into, shared with "partners", bundled into data broker feeds, and eventually exposed in a breach.

We built TempMailGrab because that is a bad deal for users. Disposable email addresses are not a hack or a workaround — they are the correct tool for the job when the job is "receive one email and move on." A temporary inbox handles the verification, completes the flow, and then disappears. Nothing to track, nothing to breach, nothing to unsubscribe from.

The secondary motivation was developer tooling. Email flows are notoriously difficult to test in CI/CD pipelines. Shared test inboxes cause race conditions when tests run in parallel. Mocked SMTP servers hide real delivery problems. We wanted a service that behaved like real email — because it is real email — but was designed from the ground up for programmatic access: REST API, webhook delivery, and OTP extraction built into every response.

The Architecture: Why Cloudflare Edge

TempMailGrab runs on Cloudflare's global network rather than a single traditional application server. When you open the app, your request is handled by a Cloudflare Worker close to you, and inbound mail is routed into the same platform for parsing and storage.

We chose this architecture specifically because the alternatives did not meet our privacy and performance requirements:

  • Traditional VPS/cloud servers would mean a single geographic footprint, higher latency for non-US users, and more attack surface to manage. Cloudflare Workers have no persistent process — each request starts fresh in a V8 isolate, so there is no long-running server to compromise.
  • Third-party email providers (SendGrid, Mailgun, Postmark) see every email that passes through them. TempMailGrab uses Cloudflare Email Routing, which routes inbound SMTP directly to our Worker's email() handler. No external provider ever sees your verification emails.
  • Traditional databases would require managing connection pooling, backups, and geographic replication separately. Cloudflare D1 (SQLite at the edge) and R2 (object storage) are built into the same platform, with data processed in the same network as the compute — no cross-provider data transfer.

The full stack in detail:

  • Cloudflare Workers (Hono framework) — handles HTTP requests, SSR rendering, API calls, and email ingestion events. TypeScript throughout.
  • Cloudflare D1 (SQLite) — stores inbox metadata, email records, extracted OTPs, API keys, sessions, and webhooks. Schemas are versioned; migrations run deterministically on each deploy.
  • Cloudflare R2 — stores raw MIME blobs and email attachments. Attachments are served only through time-limited signed URLs — they are never publicly accessible by default.
  • Cloudflare Email Routing — receives inbound SMTP for all our domains and delivers it to the Worker email() handler in milliseconds. No third-party relay involved.
  • Durable Objects (InboxStream) — one Durable Object per inbox, holding the live WebSocket connections that push new mail to your browser the instant it arrives. No polling, no 3-second delay.
  • Cloudflare Queues — decouples email ingestion from storage. The Worker enqueues raw MIME messages and processes them at controlled concurrency, preventing burst-load from overwhelming D1.
  • Rate limiting and abuse controls — per-IP limits on inbox generation and per-key limits on the developer API keep the service usable without turning disposable email into an abuse channel.

Our Privacy Commitments — In Plain English

Privacy is not a checkbox we ticked — it is the founding reason TempMailGrab exists. Here is exactly what we do and do not do:

  • We do not know who you are. Anonymous inboxes require no account, no email, no name. The only identifier is a cryptographically random string in your browser's session cookie.
  • We do not attach IPs to inboxes. Inbox creation uses brief IP-based rate-limit records for abuse prevention, but the IP is not stored on the inbox or message record. The plain-language privacy explained page spells this out.
  • We do not build the web product around ad tracking. The site has no Google Analytics, no Google Tag Manager, no advertising pixels, and no tracking cookies. Cloudflare's cookieless analytics beacon is the only analytics script admitted by the Content-Security-Policy.
  • Everything expires automatically. Standard inboxes last 24 hours and can be extended once to 48 hours. The dedicated 10 minute mail page exists for users who want a shorter session. When an inbox expires, the inbox record, email records, and attachment blobs are purged by a scheduled Worker.
  • Emails are not indexed for advertising. We parse incoming email to extract OTPs and verification links. We do not read, analyze, or profile email content for any purpose other than the feature you are using.
  • Our Privacy Policy is written in plain English. See tempmailgrab.com/privacy — not a wall of legal boilerplate, but a clear description of what we store, for how long, and under what conditions we would disclose it.

OTP Extraction: How It Works

When an email arrives, our parser runs a multi-pass extraction algorithm over both the plain-text and HTML representations of the body:

  1. Candidate identification — find all numeric sequences of 4–8 digits in the email body
  2. Context scoring — score each candidate by proximity to keywords: "code", "OTP", "verification", "passcode", "PIN", "one-time", "temporary"
  3. Negative scoring — penalise candidates that look like phone numbers (10+ digits with country code), years (1980–2040 range), prices (preceded by $ or €), order numbers (preceded by #), and tracking numbers
  4. Link extraction — all URLs in the email body are extracted and filtered to surface verification and confirmation links (by pattern-matching common URL paths: /verify, /confirm, /activate, etc.)

The result is surfaced in the inbox list view — the OTP is highlighted with a one-click copy button, and the API returns it as the extracted_otp field on every message object. The algorithm works correctly on over 95% of OTP emails from major services in our testing.

The Developer API

Every capability in the UI is available through a versioned REST API. The API was designed specifically for the workflows that existing services made difficult:

  • Parallel test isolation — create a unique inbox per test run; no shared state between concurrent tests
  • OTP assertion in tests — the extracted_otp field eliminates regex parsing from test code; poll the API until the field is non-null
  • Webhook-driven CI — register a webhook per inbox; receive a push the instant mail arrives instead of polling every 2 seconds
  • Synthetic email injection — POST to /api/v1/inbox/:id/test-message to inject a test email without a real sender; useful for developing your OTP-parsing logic before you have a live integration

See the API documentation for endpoint reference, authentication, rate limits, webhook signatures, the OpenAPI spec, and code examples in cURL, Python, and Node.js.

Who We Are

TempMailGrab is built and maintained by a small software team that uses disposable email for evaluating SaaS products, isolating test environments, and keeping primary inboxes clean. The public domain is young, and that is a real trust gap compared with older brands. The way to close it is not to pretend otherwise, but to keep publishing verifiable product, privacy, security, and research signals.

Every major feature is tied to a practical problem: OTP extraction because copying codes from raw email is tedious, webhook support because polling burns rate limits, public compatibility research because disposable-email acceptance changes, and status reporting because email delivery can fail silently.

Proof Pages

If you are evaluating the service rather than just using it once, start here:

  • Privacy explained — what is stored, how long it lasts, and what is not end-to-end encrypted.
  • Security — TLS, retention, API keys, extensions, and responsible disclosure.
  • Service status — monitored website, API, inbound email, and OTP extraction checks.
  • Compatibility research — public dataset and methodology for disposable-email acceptance.

Get in Touch

We respond to every message within 24 hours on business days.

See the contact page for all support channels.