A throwaway inbox that lives for ten minutes.
For one-time verifications, QA test runs, and gated downloads. Copy your temporary address, receive mail over TLS, and let it auto-expire after 600 seconds.
A random 6-character @tenmin.app address is generated in your browser with zero registration.
One-time codes, confirmation links, and staging test emails arrive in seconds over TLS.
Our edge storage expires the inbox record automatically after 600 seconds with no backups or logs.
How a 10-minute disposable inbox works.
Much of the automated email sent across the web consists of one-time tokens, staging test notifications, and gated download links. None of that traffic belongs in the same mailbox as your personal or corporate correspondence. tenmin.app provides a short-lived address that accepts standard SMTP deliveries for ten minutes and then purges itself automatically.
When a disposable address is the right tool
An ephemeral inbox fits best when the sender only needs to reach you once, the message arrives within minutes, and you do not need a permanent record afterward:
- Staging and QA email testing. Point your staging environment at a
@tenmin.appaddress to verify SPF, DKIM, and DMARC headers or inspect HTML rendering without cluttering shared team mailboxes. - Gated documentation and whitepapers. Receive a single PDF or resource link immediately without entering a multi-week marketing drip sequence.
- One-time verification codes. Evaluate a developer tool, sandbox demo, or forum registration that requires initial email confirmation.
- Single-use promotional unlocks. Claim a one-time coupon or download code delivered in a welcome email.
When to use a permanent address or alias instead
Do not use tenmin.app for any account where losing future email access would cause a problem. After ten minutes, all stored messages are deleted and the address stops accepting mail:
- Never use it as a recovery address for important accounts. If you need a password reset weeks later, the inbox will no longer exist.
- Never use it for sensitive or confidential data. Temporary inboxes do not require authentication; anyone who queries the same six-character hex ID during its active 10-minute window can view its messages.
- Do not use it to bypass compliance or anti-fraud checks. Regulated services require persistent contact information, and our terms of service prohibit abuse or ban evasion.
Featured engineering guides & deep dives
Our systems architecture team at Koracle LLC publishes technical guides on serverless email infrastructure, DNS authentication protocols, browser XSS isolation, and email privacy:
- Edge SQLite · 13 minMigrating ephemeral TTL state from eventually consistent KV caches to serverless SQLite
Eliminating negative-cache polling lag, rejecting unallocated inboxes at the SMTP boundary, and reaping expired leases asynchronously.
- Browser Security · 11 minPreventing XSS when rendering untrusted HTML emails in a browser
Defense-in-depth HTML sanitization, SVG/CSS attack vectors, and zero-privilege sandboxed iframe isolation.
- Edge Compute · 13 minHow RFC 5322 MIME parsing works in serverless edge environments
Handling RFC 5322 ReadableStream payloads, multipart boundaries, transfer encodings, and isolate memory limits.
- DNS & Auth · 12 minHow to test SPF, DKIM, and DMARC records in staging environments
Isolating staging DNS zones, avoiding the 10-lookup SPF ceiling, rotating DKIM selectors, and verifying DMARC alignment.
- Architecture · 14 minHow tenmin.app works under the hood: ephemeral edge email architecture
End-to-end walkthrough of edge SMTP ingress, isolated MIME parsing, 600-second TTL leases, and zero-retention design.
- Developer QA · 12 minA developer's guide to testing transactional email with a disposable inbox
QA testing password resets, magic links, signup flows, and template rendering without polluting shared mailboxes.
How the edge pipeline works
When you open this page, your browser generates six random hexadecimal characters and polls our read API for <id>@tenmin.app every three seconds. Our inbound SMTP gateway accepts traffic for active *@tenmin.app leases over TLS, parses the RFC 5322 MIME envelope in an isolated serverless runtime, and stores the message with a 600-second expiration timestamp. Once the TTL elapses, the lease expires automatically without persistent archives.
The frontend renders HTML messages inside a zero-privilege <iframe sandbox=""> after stripping scripts, styles, and event handlers. Even if an inbound message contains malicious markup, it executes in an opaque null origin with script execution disabled.
How we keep this free
Running tenmin.app on a stateless edge architecture keeps our operational footprint lean. Domain renewals and ongoing maintenance by Koracle LLC are supported by voluntary reader tips and contextual ad placements on our static editorial pages.
We never sell access to inbound messages or use message contents for ad targeting. Advertising is restricted to editorial content and is automatically suppressed whenever an inbox displays received mail.
Quick FAQ
Common questions about tenmin.app. See the full FAQ page for detailed technical answers.
Will the address still work after I close this tab?
Yes, for up to ten minutes from when it was last refreshed. The address is tied to the storage record rather than the browser tab, so any mail delivered before the timer expires is stored until the 600-second TTL elapses.
Can I receive sign-in codes and password reset links?
Yes. Most one-time codes, magic links, and verification emails arrive within seconds. Financial institutions, government portals, and regulated platforms block disposable domains at signup; for those services, use your permanent email address.
Why doesn't the inbox show attachments inline?
We render the text and sanitized HTML body inside an isolated sandbox without auto-executing attachment previews. If you need to inspect raw headers or MIME parts, use the Raw .eml download button on any message.
Is the mail encrypted?
Inbound SMTP connections use TLS in transit at the network edge. At rest, messages live in ephemeral storage and are permanently deleted after ten minutes.
How is this different from forwarding everything to a Gmail alias?
A forwarding alias is a persistent address that routes mail into your real inbox. tenmin.app is an ephemeral address that routes into a temporary 10-minute buffer and then expires completely. For long-lived accounts, use an aliasing service like SimpleLogin or Addy.io. For one-time verification flows and QA testing, use tenmin.app.
Documentation & policies
The About page documents our system architecture and introduces Koracle LLC (koracle.ai), the software engineering company that operates tenmin.app. The Guides section covers SPF/DKIM/DMARC testing, serverless MIME parsing, XSS sandboxing, and email privacy. Our Privacy policy and Terms of service detail our zero-retention data handling and acceptable-use rules, and the Contact page lists direct channels for support, security, and legal inquiries.