How zapmail Works
Not marketing copy — this is the actual request path, from typing an address to a message landing in your inbox, and exactly what happens to that message a week later.
1. Creating an address mints a token, not an account
Typing a local-part (the part before the @) and submitting the form calls an internal API that validates it — 3 to 32 characters, no spaces or "@", and not a reserved system name like admin or postmaster — then creates two database rows: a permanent mailbox record for the address itself, and an assignment record representing your ownership of it.
The assignment is what actually gets a secret token: 32 random bytes, hex-encoded, generated once and returned to you exactly one time. That token — not a username or password — is the only credential the service ever issues.
2. Inbound mail arrives through real email infrastructure
The address's domain is configured with real DNS mail records, using Cloudflare Email Routing to catch anything sent to any address at the domain. A worker script parses the raw MIME message — decoding quoted-printable and base64 bodies by hand — into a plain sender, subject, text, and HTML payload.
That parsed message is then POSTed to the application's inbound endpoint over an authenticated webhook (a shared secret sent as a bearer token), which looks up the destination mailbox and attaches the message to whichever assignment currently holds it.
3. Your inbox updates live, without polling
Viewing an inbox calls an RPC that checks your token against the mailbox's active assignment before returning anything — an invalid or expired token gets nothing back, not even an error that reveals whether the address exists.
New messages also broadcast over a private, token-scoped realtime channel the moment they're inserted, so a message appears in your open inbox tab within moments of arriving, with no manual refresh.
4. Reassigning an address is a clean handoff
Because the address is separate from the token, an address can be "reassigned": the current assignment is closed and a brand-new token is issued for a fresh assignment on the same address. The instant that happens, the old token stops working — there's no grace period.
This is what makes a zapmail address permanently reusable instead of a one-shot, unlike temp-mail services that generate a new random address for every session.
5. Message content expires on a fixed schedule — the address doesn't
A scheduled job runs once a day and deletes message rows older than 7 days, based on when they were received. This only removes message content; the mailbox and assignment rows (the address and its current token) are never touched by this job and persist indefinitely.
In other words: the address you create today will still work in a year, but any individual message you don't act on will be gone a week after it arrives — plan accordingly for anything you might need to reference later.
6. What this design deliberately doesn't do
There's no outbound sending — the service only ever receives mail, which keeps it out of the business of being a spam or phishing relay.
There's no password reset, no linked recovery email, and no support-driven account recovery — the token is the entire access model. That trade-off is what lets mailbox creation stay instant and anonymous, but it also means the service is unsuitable for anything you can't afford to lose access to.
Curious what the address is (and isn't) good for once it's set up? See Features or the full FAQ.