Is Guerrilla Mail safe? What it protects, and what it does not

Is Guerrilla Mail safe? For the job most people use it for, yes. It is a long running disposable inbox that keeps your real address out of forms you have no reason to trust, without asking you to make an account. What it is not is private, and that distinction is the whole answer. Guerrilla Mail says so itself on its about page: anyone who knows the Inbox ID may have access to that inbox. There is no password on it. So “safe” here means safe to hand to a mailing list, not safe to receive anything you would mind a stranger reading.

What Guerrilla Mail is genuinely good at

Credit where it is due. The honest version of “is Guerrilla Mail safe” starts with what it does well: it has been running for well over a decade, it works with no app and no login, and it is unusually candid about its own limits in a category full of vague promises.

The core safety benefit is real: every form you fill in is a future breach notification. An address that dies in an hour cannot be correlated with the rest of your life, sold into a list, or used to reset anything. That is the reason a temporary address is worth using at all.

It also ships a feature aimed at the weakness below. Scramble Address gives you a scrambled version of your address to hand out, so the recipient cannot work out the underlying Inbox ID and open your inbox.

The addressing model is the entire safety story

Disposable inboxes come in two designs. In the first, the address is the credential: type jenny into the box and you are in jenny’s inbox. That is Guerrilla Mail, and it is not a bug: it is what lets the service work with no account. But it means a short or guessable address is effectively a public mailbox. People guess them, and scripts enumerate them.

In the second design, the address and the key are separate things. That is how InboxDome works: an inbox has an unguessable public ID of about 128 bits, plus a separate access secret of about 256 bits. Only a keyed hash of that secret is stored, and the secret travels in the URL fragment and an authorization header, never in a query string, a server log, or a referrer header. Knowing the address alone gets you nothing. The details are on the security page.

Scramble Address narrows that gap, and it is the right instinct. It is still one shared value rather than two, so it hides the door rather than locking it.

One hour of retention is a feature and a trap

Guerrilla Mail keeps incoming email for one hour, then deletes it. Half of “is Guerrilla Mail safe” is answered right there: an inbox anyone can open is far less dangerous when there is nothing sitting in it.

The trap is practical. A verification code is fine inside an hour. A receipt, a shipping notice, or a message you wanted to reread tomorrow is not. And the address itself does not expire the way the mail does, so an old signup can keep delivering into a mailbox that anyone who guesses the ID can read.

InboxDome sits differently: a consumer inbox lasts 24 hours by default, extendable to at most 7 days, and then it is destroyed. You can delete an address yourself at any time, and it stays dead. Longer than an hour, still short enough to be disposable. What is kept, and for how long, is listed on the retention page.

Anything you send from it carries your IP address

Guerrilla Mail includes a compose feature, and its terms of service state that outgoing mail gets an X-Originating-IP header containing your IP address. That is a reasonable anti-abuse measure, and the service is upfront about it. It is still worth knowing: people assume no signup means untraceable.

This is one reason InboxDome is receive only, permanently. An inbox that cannot send cannot spoof or spam anyone, and has no outgoing header to worry about.

What no disposable inbox can make safe

Some risks belong to email itself, not to any provider:

• Transport. Encryption between mail servers is opportunistic, not guaranteed. RFC 3207 notes that an attacker in the middle can delete the server’s STARTTLS offer, and the sender will then not encrypt at all. You have no say in how your mail was delivered.
• Tracking. HTML email loads remote images, and each load tells the sender you opened it, when, and roughly where. InboxDome blocks them by default, but assume everywhere that opening an email is an event someone records.
• Recovery. Never point a password reset, a two factor backup, a bank, a payroll system, or a work login at a throwaway address. When the inbox dies, so does your route back into the account.
• Rejection. Plenty of sites detect and block disposable domains outright, and Guerrilla Mail’s are among the oldest entries in every blocklist.

When Guerrilla Mail is the better choice

Pick Guerrilla Mail when you want the shortest possible retention and would rather the mail vanish within the hour. Pick it when you need to reply from a throwaway address, because InboxDome cannot send at all. Pick it when you want to reopen the same address later from a different device just by typing the ID again, which is precisely what makes it less private.

Pick InboxDome when you want the inbox locked to a secret only your browser holds, when an hour is not long enough, when you want email HTML sandboxed and remote images blocked by default, or when this is a work job and you want an API with one isolated inbox per test. Our comparison page is equally blunt about where a hosted receiver is the wrong tool.

Using any throwaway inbox safely

1. Assume every message in it is readable by someone else, because on most services it is.
2. Keep account recovery, payments, and work identity away from it, permanently.
3. Do not put your real name in the address. The local part is public.
4. Delete the address when you are done rather than waiting for expiry.
5. If you will need the message tomorrow, you needed a real mailbox today.

So, is Guerrilla Mail safe? For junk, yes, and it has never pretended to be more. If you want a throwaway inbox that a stranger cannot open by guessing the name, you want the two value design instead.