About ShieldMail

ShieldMail is a free temporary email service. This page explains who is behind it, how it works underneath, and where the money comes from, because those are the three things you should want to know about any service that handles mail.

Who runs it

ShieldMail is an independent project, not a company with a team. It is built and maintained by one person — details and contact are on the authors page — who is responsible for the code, the writing, and anything that goes wrong.

That is worth stating plainly because it sets expectations. There is no support rota and no service-level agreement. There is one mailbox that is genuinely read, listed on the contact page.

Why it exists

Most of what arrives in an inbox is not correspondence. It is a receipt, a download link, a one-time code, or a coupon. Routing that traffic through an address you have owned for a decade is what turns a mailbox into a landfill, and what puts a durable identifier for you into an unknown number of marketing databases.

There are plenty of temporary email services already. This one was built because the existing ones tend to share three habits worth avoiding: they render message HTML without sanitising it, they cover the page in ad units around the inbox itself, and they are vague about where your mail is actually held.

How it works underneath

This part matters, and most services in this category do not explain it.

ShieldMail does not run a mail server. It has no MX records, receives no SMTP traffic, and stores no mailboxes. It is a front end over several third-party temporary mail providers.

When you open the site:

1. The server asks the first provider in its chain that passed a recent health check for a mailbox.
2. The provider creates one on a domain it owns and returns an address plus an access token.
3. The token is stored in an HttpOnly cookie, unreadable by the JavaScript on the page.
4. Only the address is sent to your browser.

When you press Refresh, the server uses that token to poll the provider and passes the result back. Message HTML is sanitised server-side first: scripts removed, iframes stripped, remote images blocked so tracking pixels do not fire.

The consequence you need to understand: your mail physically sits on infrastructure belonging to a third-party provider, under that provider's retention policy — not ours. We can describe our own handling accurately, and we cannot make promises on their behalf. The privacy policy sets out exactly what each party receives.

There are usually four providers configured. If one is unavailable or rate-limiting, the next one is used, which is what the Change button lets you trigger manually.

How it is funded

Advertising, through Google AdSense. That is the entire business model.

What that means in practice:

• Google and its partners may set cookies to measure and personalise ads, which you can decline via the consent banner and the cookie policy.
• Nothing about your temporary inbox is shared with advertisers. Message contents are not read, sold, or used for targeting.
• There are no ad units inside the inbox area, and no reserved space around the message reader.

There is no paid tier, no data sale, and no newsletter.

What it is not

Stated directly, because overselling is the norm in this category:

• Not anonymity. The site you sign up to still logs your IP address, your browser fingerprint, and every field you fill in. Withholding an email address removes one identifier from that set.
• Not private. These mailboxes have no password. Anyone who knows the address can read it while it is alive.
• Not permanent. Sixty minutes by default. Expired mail is unrecoverable by anyone, including us.
• Not a way around rules. Ban evasion, duplicate accounts, and repeat free trials are outside acceptable use.

If you need an address that survives, you need an alias or a real mailbox. The reasoning is in disposable email vs email alias.

About the writing

The articles and guides on this site are written by hand, by the person named on the authors page. They carry a byline, a publication date, and a last-updated date.

Between June and July 2026 the site was substantially rebuilt: nineteen machine-translated language versions were withdrawn, twenty-three overlapping articles were consolidated into thirteen, and everything remaining was rewritten. The earlier versions were low quality, and removing them was the right call.

FAQ

Is ShieldMail a company?

No. It is an independent project run by an individual, funded by advertising, with no corporate entity behind it.

Do you read my messages?

No. Message bodies pass through the API route to your browser and are not written to any ShieldMail database. The upstream provider that received the mail holds its own copy under its own policy.

Which mail providers do you use?

Several third-party temporary mail services, selected at request time by health and availability. The specific mix changes as providers come and go, which is why the site is built around a fallback chain rather than one supplier.

Can I pay to remove the ads?

There is no paid tier. Advertising is what keeps the service free and available without an account.

How do I report a problem?

Through the contact page. Include what you did, what you expected, and what happened instead.