How to use temporary email without treating the address as a login

The short answer

Use a temporary email address when you need to receive a message for a short task — a signup code, a download link, a merchant confirmation — and you do not want that traffic permanently attached to your primary mailbox. Do not treat knowing the address as proof that someone can open the inbox. On Mailby, read access stays with your browser session (or a recovery secret you control).

That distinction is the whole product bet: open a Quick Inbox, paste the address into the form that needs it, wait for delivery, copy the code, then let the retention clock expire — or delete early.

Why address ≠ access

Public disposable inboxes trained people to believe “whoever has the string can read the mail.” That model is convenient for throwaway signups and terrible for privacy. Anyone who sees the address in a screenshot, support ticket, or leaked form dump can watch your codes arrive.

Mailby binds authorization to a private session cookie on mailby.app. Senders still deliver to the address through receive-only mail on mail.mailby.app. They cannot open your UI. If you need to move devices, use recovery — not public address lookup.

When a short-lived address is the right tool

• One-time merchant or newsletter signup where you only need the confirmation
• OTP challenges for services you do not want on your primary identity
• QA or demo flows where a durable mailbox would create cleanup debt
• Sharing a receive address for a narrow window without handing over read access

When you should keep a durable mailbox

• Banking, government, employer, or legal identity that must remain yours for years
• Accounts you will reset passwords on months later
• Anything where losing the receive lease would lock you out permanently

How Mailby clocks work

Receiving lease and message retention are separate. When receive ends, new mail stops. When retention ends, stored content is purged on schedule. Free Quick Inbox defaults are short by design. Privacy Pro extends clocks when an hour is not enough. Developers can drive inbox lifetime through the temporary email API.

Details live on data retention and the trust center.

A concrete workflow

1. Open /inbox and allocate an address.
2. Paste it into the signup or OTP form.
3. Keep the Mailby tab available — live delivery surfaces codes without refresh roulette.
4. Copy the OTP or action link from the safe preview.
5. Delete the inbox when finished, or let retention expire.

Failure cases to expect

• Some services block known disposable domains. That is a policy choice on their side, not a Mailby “bypass.”
• If your session cookie is cleared and you did not save recovery, you lose read access even if the address still exists.
• Attachments and HTML are sanitized for safety — remote trackers stay blocked by default.

Related reading

• How temporary email works
• Temporary email features
• Security & data handling

Sources and limits

This guide describes Mailby product behavior as implemented on mailby.app (session-bound Quick Inbox, receive-only MX, retention purge). It is not legal advice and does not claim anonymity guarantees or universal acceptance by every third-party service.