Guerrilla Mail: the one-hour inbox and what the sources say

What you get when you arrive

Wikipedia describes Guerrilla Mail as a free disposable email address service launched in 2006, and says visitors are assigned a random address when they arrive. The service’s About page says there is no need to register: you visit, a random address is given, and you can also choose your own. It adds that you can hand the address to someone you do not trust, read the email, click a confirmation link and then delete it. Wikipedia and a TechRadar review both place the start in 2006; Wikipedia adds Chicago, citing a 2014 newspaper report.

The home page, read on 29 October 2026, shows a field for the part before the @ sign, which the About page calls the inbox ID, and a list of domains for the part after it: sharklasers.com, guerrillamail.info, grr.la, guerrillamail.biz, guerrillamail.com, guerrillamail.de, guerrillamail.net, guerrillamail.org, guerrillamailblock.com, pokemail.net and spam4.me. Beside the address are buttons for Copy to clipboard and Scramble Address, and the menu reads Email, Compose, Tools and About. The counter on that page said the service had processed more than 21 billion emails; TechRadar, in 2021, gave over 13 billion, so the two readings differ by their dates rather than by a disagreement.

The About page also lists what runs the service: an Nginx web server, a MySQL database and a mail server called Go-Guerrilla, with a front end written in PHP and JavaScript that uses jQuery. It says the front end relies on the service’s own API for everything on the site. Go-Guerrilla is open source, and the README on GitHub describes it as an SMTP server written in Go for receiving large volumes of email. It started as a project for GuerrillaMail.com, is released under the MIT licence, and does the work of a mail transfer agent without the sending functionality.

How long a message stays

The About page answers the question in its FAQ. The current version keeps all incoming email for one hour, which, it says, means all addresses work all the time and never expire. When an email arrives it waits in quarantine. If a user checks the inbox, the service looks in quarantine for new mail and moves it into the inbox at once; mail that waits there longer than an hour is deleted. Once a message is in an inbox it has one more hour, or until the user deletes it. The page also says that emails never delivered to an active inbox are marked abandoned and are most likely spam. The older version of the service, it says, expired the address after an hour and bounced inactive addresses.

The other sources give the same hour but word the starting point differently. Wikipedia says emails sent to addresses are kept for one hour before deletion. TechRadar says all emails are deleted one hour after being delivered or opened, and later that read messages are deleted after an hour. The About page counts the second hour from the moment a message reaches the inbox. The pages we read do not reconcile the three wordings, and they do not say what happens to a message that is opened part-way through its hour.

The About page also says there is no spam folder: every email that arrives is delivered to the inbox, and one that did not arrive is most likely a problem on the other side. It suggests a use for this, which is that a webmaster can test whether a site sends its emails correctly. On privacy, the page says the service deletes all email delivered to an inbox after one hour and normally keeps its logs turned off, because with high traffic the server does not have the resources for them. It lists a session cookie and third-party cookies including Google Analytics and Google Adsense, says anonymized data from obvious spam may be used for anti-spam, anti-malware or anti-phishing research, and says the site can only be reached over HTTPS. The pages we read do not say whether deleted mail also leaves backups.

Who can open the inbox

The About page puts the reason in its FAQ: because Guerrilla Mail does not require account registration, anyone who knows the inbox ID may have access to that inbox, so it is best to use a random address. The Privacy section repeats that anyone who knows an inbox ID may access it. TechRadar, which gave the service a positive verdict on 30 June 2021, lists “Anyone can access any inbox” among its cons, and, in its features section, says that anyone can access any inbox if they have its address. Its pros include a streamlined interface and the phrase “100% anonymous at all times”.

The site’s remedy is the Scramble Address button. The About page describes a scrambled address as extra protection: it can only be known if the inbox ID is known, and it cannot be used as an inbox ID. It adds that the harder the ID is to guess, the better the alias protects you. TechRadar describes the scrambler as making it easier to maintain privacy and to reduce the risk of prying eyes. The pages we read do not give a figure for how hard an ID is to guess, so how much protection a given ID offers is not something they let us state.

For readers who want a different kind of address, TechRadar names two alternatives. Dispostable is described as offering very similar services. ProtonMail is described as a true secure email provider with a dedicated inbox, end-to-end encryption and a zero-access policy, with most features behind a paid plan. A permanent address that forwards to a real mailbox is a different tool from a one-hour inbox; the temp mail page sets out the difference.

What the sources suggest the inbox is for, and what they do not cover. The About page describes the intended use: give the address to someone you do not trust, view the email, click any confirmation link, then delete it. Taken together, the facts above (mail kept for about an hour, an inbox anyone can open with its ID, and the cookies and domain episodes described below) mean it fits that single-use case. The pages we read for this page do not say what happens if you need to recover an account or receive a second message later; that is our reading of the sources, not a statement from them, and we tested nothing. The home page also carries a Forget Me button, whose effect the pages we read do not explain.

Sending, anonymity and the own-domain offer

The sources disagree about sending. TechRadar, in 2021, says you can view, forward, reply to or delete messages in the inbox. Wikipedia says that on 20 August 2023 the site came back online with the sending of outgoing emails suspended until further notice, citing a post on X. The home page read on 29 October 2026 still shows a Compose entry in its menu. The pages we read do not say whether sending works today, so this page does not claim it does.

Anonymity is the second disagreement. TechRadar calls the service fully anonymous. A Hacker News comment from 5 November 2020, posted under the name flashmob and opening with the words “Admin of Guerrilla Mail here”, describes the site as first and foremost an anti-spam solution, says the website does not call itself an anonymous email provider, and says the sending feature warned users that their IP address would be included in the email headers. The same comment says the sending feature was for the rare chance that a user needed to send or reply, and that the service is mostly used for receiving. We could not check who owns the account, so the comment is reported as written.

The third difference is the own-domain offer. The home page asks whether you own a domain, says mail arriving at it will be accessible only by you unless you give access to everyone, and shows a price of $9.99 USD a year, payable by Bitcoin or PayPal. TechRadar, in 2021, says a premium service for using your own domain was retired for lack of demand and that new orders were unavailable. Both are in the table of differences below. The pages we read do not say whether the offer on the home page works today.

Block lists, a host and a domain

A public list on GitHub, johnduhart/throwaway-email-blacklist, collects throwaway email domains. Its domains.txt has a section headed Guerrilla Mail that names eight domains: guerrillamail.com, .org, .net, .biz and .de, guerrillamailblock.com, sharklasers.com and spam4.me. That is eight of the eleven on the home page’s menu; guerrillamail.info, grr.la and pokemail.net are not in the section. The file carries comments dated 2013, one of which marks another service as dead. The list shows that the domains appear on a third party’s list. The pages we read do not say which sites check lists like it, so it does not show that any particular site refuses these domains.

Two episodes involve the people who host and register the domains, both reported by the service or its commenters. In the 2020 comment, the admin says the site had been hosted at OVH since 2016, that OVH wrote on 12 October saying the server was used for a fraudulent activity, and that on 4 November the server was suspended. The comment says the server was in rescue mode and had not been seized. Wikipedia says that on 4 November 2020 the site stated on Twitter that OVHcloud had shut it down over a law enforcement request, details of which OVHcloud would not give.

The second episode is a Hacker News discussion of 18 January 2022. It quotes messages from the service’s account saying that a registry was about to delete guerrillamail.org because of a SURBL listing the service calls a false positive, that the domain only receives email and sends web visitors to the main site, that it has belonged to the service since 2006, and that this was not the first time, the quoted posts saying the service had been through it a few times that year (the posts are undated in the page we read). One commenter suggests missing DNS records could matter; that is the commenter’s guess, and we checked no records. The pages we read do not give the registry’s or OVHcloud’s account of either case.

Go-Guerrilla has its own history. The README’s latest release is v1.6.1, tagged on 28 December 2019, and a note dated 31 August 2023 from a contributor says the original owner appears to have abandoned the project and that the contributor mirrored it. The note concerns the open-source mail server, not the website, and the About page still names Go-Guerrilla as the project behind the mail.

What we did not use

We tested nothing: we sent no message and opened no inbox. We did not read the Google Play listings for the apps, the Reddit thread asking for an alternative, or the help address guerrillamail.com/faq, which returned a page-not-found error (we did not check that it is the page behind the WTF button). The four questions below are the ones we chose to answer from the pages we did read. The statements about sending, anonymity and the own-domain offer are reported as each source gives them, with their dates, and the table above shows where they differ.