10minemail Shared Wi-Fi and a 10-minute inbox
A common fear: if you open a temp-mail site on café Wi-Fi, the next person on the network sees your mail. On 10minemail that is not how the session works. A different fear is still true: anyone who knows the exact address might receive the same messages through the mail system while the box is alive.
Those two sentences get mashed into “is it safe on public Wi-Fi?” This page separates them.
What we bind the view to
When you create an inbox, the server returns a random token (a UUID). The browser stores it in localStorage as pobox10_token. Later requests send that token. The live stream is ?token=....
We do not key the inbox on your IP. If we did, a café NAT would smash strangers into one box, or a phone jumping from Wi-Fi to LTE would lose the box. Binding to IP would be worse on the networks people worry about.
So: the person at the next table, on the same public IP, does not automatically see your 10minemail tab. They would need your token or your address.
What a neighbour could still do
Steal the token. If they have access to your unlocked browser, they can read localStorage. That is a physical-access problem. Lock the screen. Do not leave a logged-in session unattended. Closing the tab does not always clear localStorage; destroying the inbox (timer or New address) does.
Know the address string. Email is a public routing system. While our timer runs, mail sent to that string can be fetched by our pipeline. In principle, someone who saw you copy jane.morris@profemail.co.uk off your screen — or who guessed a popular name combo at the right moment — could try to watch the same mailbox. Guessing is hard; shoulder-surfing is easy. Sit so the screen is not a billboard. Do not paste the address into a chat full of strangers.
Network attacks. Public Wi-Fi can still intercept other things you do: the form you paste the address into, a site without HTTPS, a captive portal. 10minemail itself is served over HTTPS. The destination form may not be a good place to type a card number regardless of email.
What we log
We may log IP and user agent on the web server for abuse and operations. That is not “the person at table four gets your inbox.” It is also not anonymity. If you need to hide your IP, temp mail is the wrong tool. Use a broader privacy setup, or do not do the task on café Wi-Fi.
The visitor cookie counts unique browsers. It is not a name. Privacy policy.
Phones, background tabs, and captive portals
Phones freeze background tabs. A frozen tab will not show a popup. Keep 10minemail in the foreground until you have the code.
Captive portals (hotel Wi-Fi “enter email to get access”) are a classic throwaway use. If they only want email, a 10-minute inbox is often enough. If they want a room number and a card, that is the hotel’s process, not a privacy puzzle.
Shared computers
A library PC is worse than café Wi-Fi. The next user may have the same browser profile. When you finish, click New address or wait for expiry, and consider clearing site data if you used a public profile. Do not save the address in the shared password manager.
Private windows still have localStorage for the session. Closing the private window drops the token from that session. The server-side inbox may still live until expiry. That is fine: nobody at the keyboard has the token. The address string could still receive mail into a box nobody is watching, and then we delete it.
What “safe enough” means here
On shared networks, 10minemail is safe enough for a one-time code if:
- you keep the screen reasonably private
- you do not put secrets in the message
- you do not use it as a bank
- you finish before you walk away
It is not safe enough for confidential attachments, for leaving the tab open while you buy lunch, or for pretending you are off the grid.
The security page is the general model. Is temp mail safe? is the job-matching version. This page is only the network-shaped slice.
VPN plus temp mail
A VPN hides your IP from the sites you visit. It does not hide the address string from the mail system. Using both is fine for a one-off code. Using both does not make a bank signup safe. Do not stack tools until you feel invincible; match the task.
Café Wi-Fi does not merge our inboxes. It also does not make a throwaway address a secret. Treat the string like something you said out loud, finish the task, and let the timer shred it. Open the inbox when you can watch it.