Security
Last updated July 25, 2026
How TempMail protects your data and the people who receive mail through it.
Encryption in transit
Every connection to TempMail — the website, the API, and inbound mail delivery — is encrypted with TLS/HTTPS. There is no unencrypted path to any part of the product.
Message sanitization
Every message's HTML is sanitized before it's ever rendered: scripts, tracking pixels, and event handlers are stripped, and remote images are proxied so senders can't learn when or whether you opened a message. This runs on every message, automatically, with no configuration required.
Access control
Guest inboxes are protected by a random, high-entropy access token that only your browser holds — knowing an inbox's address is not enough to read its contents. Accounts are protected by Supabase Auth (bcrypt-hashed passwords, or OAuth where you choose it) and row-level database security that scopes every query to its owner. API keys are stored as one-way hashes; the raw key is shown to you exactly once, at creation.
Infrastructure
TempMail runs on Vercel (application hosting), Supabase (database and authentication), and Cloudflare (inbound email routing and network edge), each independently responsible for the physical and network security of their platforms. We do not operate our own servers or store data outside these providers.
Responsible disclosure
If you believe you've found a security vulnerability in TempMail, email [email protected] with details. We ask that you give us a reasonable opportunity to investigate and fix an issue before any public disclosure, and we will not pursue legal action against good-faith security research conducted under this policy.