Disposable and temporary email for sign-ups

NeMail hands out a random address on one of 15 domains and shows incoming letters right on this page. There is no account, no password, and you cannot send a letter from such an address. You need it when a service demands an email for the sake of one letter: a confirmation code, an activation link, a file handed over "in exchange for an email".

The second common case is checking your own form. A developer or a marketer takes a fresh address, signs up on their own landing page and looks at whether the letter arrived, how it looks and whether some unsubstituted variable is still sitting in the text. No need to keep a dozen test mailboxes for that: a new address appears at the press of a button.

Your main inbox also stays clear of mailing lists. If a service sells or loses its database, what ends up in there is an address whose letters nobody reads. Where the rules of a service forbid disposable email outright, though, don't sign up this way: the account can be closed at any moment, and you won't get it back through an address like that.

Mail on these domains is taken in by Cloudflare Email Routing. A catch-all rule hands every letter to a worker, which parses it and passes it to the affpapa.org server. That is why the mailbox does not have to exist in advance: the server will accept a letter addressed to any name made of Latin letters, digits, dots, hyphens and underscores. The "Get an address" button simply makes up a name out of two English words and six random characters, say swift-otter-k7m2qx. The domain is picked in the list above the inbox; right now there are 15 of them: a.rip, affpapa.click, affpapa.biz, affpapa.net, affpapa.online, affpapa.pro, affpapa.site, affpapa.space, affpapa.store, affpapa.work, affpapa.works, hr.band, nearbihunter.com, tg.observer, aff.bio.

The sender, the subject and the text and HTML versions of the letter are stored, each part up to 256 KB. Attachments are dropped at intake. A letter is kept for a day from the moment it arrives, and the cleanup runs once an hour. The inbox window shows up to 50 of the most recent letters.

While the tab is on screen, the page asks the server about new letters every 6 seconds. Minimise the tab and the polling pauses; come back and it goes on. The browser keeps the last address in localStorage, so on your next visit the inbox opens by itself.

The server looks for the confirmation code itself: in the subject and the body it takes 4–8 digits sitting next to words like code, PIN, password, verification and similar, and if there are none, a single six-digit number near the start of the letter. The code is shown on a line of its own with a "Copy" button. Alphanumeric codes such as A7K2QX are not found this way — look for those in the text of the letter.

Codes from an authenticator app rather than from a letter are the job of the 2FA code generator: you paste the secret key and it issues a TOTP right in the browser. Names, addresses and other data for test sign-ups come from the test data generator. What a site sees about your connection is shown by the anonymity check, and keeping several working browser profiles apart is what the NeAntik antidetect is for.