Frequently asked questions

A disposable email address is a short-lived inbox you can use when a website or staging workflow requires an email address for a one-time interaction. It receives verification codes, confirmation links, and standard RFC 5322 messages just like a permanent mailbox, then expires automatically after a fixed TTL window. Once expired, the address and its messages are permanently removed.

Disposable addresses are designed for one-shot interactions such as coupon claims, single PDF downloads, and QA test runs where you do not want ongoing marketing emails in your primary inbox.

When you load the home page, your browser generates a random six-character hexadecimal address ending in @tenmin.app using the Web Crypto API.

Our inbound SMTP gateway accepts messages for active *@tenmin.app leases over TLS and pipes the raw MIME stream into an isolated parser. The parser validates the six-character inbox ID, decodes the RFC 5322 envelope, and stores the message with a 600-second time-to-live (TTL). The web interface polls the read API every three seconds.

When the 10-minute timer reaches zero, the storage entry expires automatically and subsequent messages to that inactive inbox are rejected at the SMTP boundary.

Ten minutes (600 seconds) is long enough to complete almost any one-time verification flow, staging test, or gated download, while keeping the exposure window short so an address used in the morning does not remain active all afternoon.

If a sender is slow to deliver, clicking the Extend button resets the 600-second TTL for your active inbox.

Yes. Every received message includes a Raw .eml download button that exports the message headers and body as a standard .eml file. Developers use this to inspect Authentication-Results headers when testing SPF, DKIM, and DMARC in staging.

No. tenmin.app is strictly receive-only. There is no outbound SMTP relay, no reply button, and no forwarding rule. Operating as receive-only prevents outbound spam abuse and protects our domain reputation so legitimate verification emails arrive reliably.

The countdown stops, client polling stops, and the inbox record expires from storage.

Any new email sent to an expired address is rejected at the SMTP layer with a permanent error code. There is no backup archive or recovery mechanism once an inbox expires.

Yes. Clicking the Extend button refreshes the storage TTL for another ten minutes so your inbox stays active while you keep the tab open.

We do not store visitor IP addresses, browser fingerprints, or user accounts linking a person to an inbox ID.

However, tenmin.app is an email compartmentalization tool, not an anonymity network. Your ISP can see connections to tenmin.app, and the website where you submit the address logs your session on their end.

No human reads messages routed through tenmin.app, and we do not run machine-learning training or ad-targeting analysis on message contents. All messages expire automatically after 600 seconds.

We use a two-layer defense against cross-site scripting (XSS). First, inbound HTML is passed through a sanitizer that strips <script>, <style>, <iframe>, inline on* event handlers, and javascript: URLs. Second, the sanitized markup is rendered inside a zero-privilege <iframe sandbox=""> with an opaque null origin.

See our technical guide on preventing XSS when rendering untrusted HTML emails for full implementation details.

Our Worker normalizes recipient local parts to lowercase hexadecimal characters matching [0-9a-f]{6}. If a sender capitalizes the address (such as ABCDEF@tenmin.app), it still routes cleanly to abcdef@tenmin.app.

tenmin.app is built and operated by Koracle LLC (koracle.ai). Read more on our About & Architecture page.

If you need an address that continues working for months or years without exposing your primary inbox, use an email aliasing service such as SimpleLogin, Addy.io, or Apple Hide My Email, or configure catch-all forwarding on a personal domain. See our disposable vs. alias architecture guide for a full comparison.