10 Minute Mail: two sites, two clocks, and who sees the inbox

Two sites share the name, and they are not one service

The words “10 minute mail” lead to more than one site. Further sites use similar names, and we read only two of them: 10minutemail.com and 10minutemail.net. The home page of 10minutemail.com showed a browser check when we opened it, so what follows about the .com site comes from its FAQ, which we read at cf.10minutemail.com/faq.

The FAQ describes 10MinuteMail as a secure temporary email service that gives you a private email address which anyone can send mail to. It says the email and the address both self-destruct in ten minutes, and that you do not need to sign up or provide any information. The copyright line at the foot of the page reads 2006–2026 Devon Hillard — DigitalSanctuary.com.

The page at 10minutemail.net calls itself a free, disposable e-mail service and carries a copyright line of 2009–2024 10minutemail.net. It is not signed with a person or company name, and the pages we read do not say whether the two sites are connected. Their pages promise different things, which is why this page keeps them apart.

Wikipedia does not name either site, but its article on disposable email addresses gives the wider category. It covers forwarding aliases and temporary inboxes, and says the temporary kind often has a planned lifespan measured in minutes, such as 10 to 60 minutes. A ten-minute inbox is one short-lived kind among several, and the article lists the others: aliases that forward, sub-addresses with a tag, and wildcards on a domain.

What the ten minutes do, on each site

The .com FAQ gives the routine as a short sequence. Open the site in another window or tab; the address shown there is yours, and you can copy it or click the icon of two sheets of paper that copies it to the clipboard. The FAQ asks you, in capital letters, not to close that window. Paste the address into the site that asked for one and finish the form. If the site sends mail, it should show up under the Messages section of the 10MinuteMail page, which the FAQ says may take a couple of minutes. You click the message to read it and then click any link in it. When you are done, you close the window or wait for the ten minutes to run out.

The FAQ adds two things you can do with a message: reply to it, since some sites require a reply, and forward it to your personal account if there is information you need to save.

What happens at the end takes one sentence in the FAQ: after the address expires, all of the email is deleted, and the address itself stops working a minute later. Asked whether it can recover a message lost or sent after the ten minutes, the FAQ says it cannot, and answers that the emails are never saved and that the writer never has access to them. If the message you are waiting for has not come, the FAQ says the link “Give me 10 More Minutes” will reset the countdown timer. The word is reset, and the FAQ does not say how many times the link can be used.

The .net page words the clock differently. It says the address expires after ten minutes, after which you cannot access it, and that you can extend the time by 10 minutes. Its feature list says you can set up to 100 minutes, and its footer carries a link worded “Give me 100 more minutes!”. Its Recovery entry says a mailbox that has just expired can be recovered before it is removed from the system; the page does not say how long that window lasts.

The two pages describe the same kind of button differently: the .com FAQ says it resets the countdown, and the .net page says you can extend the time by 10 minutes. The table sets the two side by side, row by row.

Who can read the inbox: the sites say one thing, two other writers another

Each site describes its own inbox as private. The .com FAQ says you get a private, unique email address that is not given to anyone else, and that you are the only person who can see that email’s inbox. The .net page says its mailboxes are randomly generated, that a mailbox name, once used, is not used again, and that others are not able to read your mail. Both statements are the sites’ own, and we tested nothing: we opened no inbox and sent no message.

The same FAQ is plainer about where that privacy stops. It calls the service “PRETTY secure” and explains that most email is sent unencrypted and may pass through many servers between sender and recipient, so email is not a super secure way to communicate. For really secure email it points to PGP/GPG encryption. It also says the service should not be used to do anything illegal.

Proton gives a broader warning. Its blog post of 22 July 2025 lists 10 Minute Mail among its examples of one-time email services, and says they mostly “don’t require passwords or user authentication”, so someone who knows the address can potentially read the inbox. It adds that most disposable services use public inboxes, and that they rarely use end-to-end encryption. Proton sells aliases and encrypted email, so its post comes from a party with something to sell. It speaks of disposable services in general and does not say which.

Malwarebytes, in a post of 11 March 2026, describes a different service, FakeMailGenerator, whose inboxes are receive-only and have no login, so the post says an address, or a guessed inbox URL, is enough to open the same inbox. The post’s author guesses that a scammer searched such public inboxes for passwords to reuse in sextortion emails, and says so as a guess. The post is not about 10 Minute Mail; it shows what a public inbox can mean.

The readings therefore differ. The .com FAQ and the .net page say private, Proton says most are public, and Malwarebytes documents one that was. The pages we read do not say which description fits the inboxes of 10minutemail.com or 10minutemail.net beyond what the two sites say of themselves.

The jobs the sources name for a short-lived address

The .com FAQ gives as the most common reason being asked for an email address by a website you do not fully trust. It says many sites force you to register to see content, and that many of them then send spam for years or sell the address to large-scale spam operations. An address that will not exist in ten minutes, it says, leaves no risk of spam. If the site asks you to verify by clicking a link, the FAQ says you can read the email on its page and click it. The .net page makes a similar argument: the site you register with could be selling your personal information, and you never know where your e-mail will be published.

Kaspersky’s blog puts it as advice for a site you are confident you will never come back to. Its post of 19 November 2013 says to try an email address with a very short lifespan, and names Guerrillamail.com, with addresses that last 60 minutes, and 10minutemail.com, with a 10-minute lifespan. The post is from 2013, so what it says of the two services is a 2013 reading. Wikipedia’s article on Guerrilla Mail, which we read on 4 November 2026, says emails sent to its addresses are kept for one hour before deletion.

Wikipedia’s list of what disposable addresses are used for is longer: it names sign-ups, free trials, downloads that ask for a verified email, forums, software testing, and keeping a primary address less exposed on non-essential services. That list describes disposable addresses in general, not 10 Minute Mail in particular.

Where a ten-minute address costs you the account

The FAQ’s warning is specific. If it is an important account, one for which you might need a password reset email, the FAQ says you should not use 10MinuteMail. It says people have lost accounts by forgetting the password after the address on the account had expired. For a site you trust, it says your real email address is probably the easiest. Malwarebytes gives the short version for disposable inboxes in general: do not use them for important accounts, because the mail in that inbox might be available for anyone to find. Proton names purchases, government services and other sensitive uses, and says a reset link or confirmation code sent to a burner address could be read by someone else.

Kaspersky’s 2013 advice and the FAQ’s warning mark the same boundary from two sides: a site you will not come back to on one side, an account you may need back on the other.

A second cost is that a site may refuse the address. Wikipedia says some forum and wiki administrators dislike disposable addresses, that lists exist to help detect their domains, and that website operators who expect to earn money by selling addresses may ban them. Proton says many websites automatically block these domains. The .net page says it replaces its domain name every 45 days to avoid some admins blocking it, which is that site’s own account of the problem. The pages we read do not say how many sites block 10 Minute Mail, or which.

On what to use instead, the sources speak in their own terms. Wikipedia describes forwarding aliases, where several auxiliary addresses forward to one main address and the owner can see which one receives spam and block or dispose of it. It also describes sub-addressing, where a tag is added to the address, and says whoever uses a sub-address must remember it to log in or reset the password, and that it reveals the delivery address to recipients. Proton’s alternative is its own aliases. On this site, the pages on SimpleLogin, Firefox Relay, Apple Hide My Email and plus addressing cover the permanent kind, and Mailinator and Guerrilla Mail cover two other temporary inboxes.

What we did not use

We tested nothing on either site: we opened no inbox, sent no message and used no countdown. We did not read the home page of 10minutemail.com, which showed a browser check, so the .com statements come from its FAQ alone, which carries no date. We did not read the FAQ’s Privacy Policy page, so the pages we read do not say where the mail is kept or for how long logs are held. We did not read the further sites that use similar names, so nothing on this page describes them. On the law, the FAQ says only that the service should not be used to do anything illegal, and the pages we read do not say what the law is in any country. We read every page on 4 November 2026.