Scoped inbox authority
Inbox access is tied to the browser session or to an explicitly issued, address-scoped linked-device credential. A linked device does not inherit general browser-session mutation authority.
MailOnce Security
Security is a set of enforced boundaries, not a badge.
MailOnce handles short-lived inbox access, verification messages and device-link requests. This page describes controls that are present in the product today and separates them from protections MailOnce does not claim to provide.
Access starts with proof of ownership
Protected browser-session operations require both a session identifier and a bearer ownership token. Session tokens are generated from 32 random bytes; the server stores a SHA-256 verifier and compares presented tokens with a timing-safe check instead of persisting the raw ownership token as the verifier.
Controls applied at the product boundary
Server-side verification
Ownership and credential decisions are enforced by backend guards and authorization services rather than trusted to interface state in the browser.
Short-lived realtime access
Realtime owner access uses one-time tickets with a short lifetime. Device-link status responses are marked no-store, reducing accidental caching of sensitive state.
Secrets kept out of ordinary URLs
The device-link QR carries its pairing token in the URL fragment, not the path or query. The client removes that fragment from the visible URL before claiming the pairing.
Device linking is deliberately narrower than the main session
Opening the same inbox on another device requires a pairing flow with browser-owner approval. The linked credential is built for reading one target inbox, not for controlling the original browser session.
- Pairing and continuation secrets use cryptographically random 32-byte values and hashed verifiers.
- The public pairing ID alone is not authorization; the claimant must prove the continuation secret.
- A successful exchange issues one address-scoped read profile for metadata, message list/detail and target-scoped realtime access.
- Replacing or ending the target address ends linked access because authorization rechecks the address lifecycle.
- The raw linked-device secret is not persisted; the recovery response is stored encrypted for a short recovery window.
Abuse controls are part of security
MailOnce applies source- and owner-oriented rate-limit policies and product quotas around sensitive operations. These controls are designed to make automated abuse more expensive and to keep one client from consuming unbounded shared capacity. They are safeguards, not a promise that abuse can never occur.
What this page does not promise
- MailOnce does not certify that a sender, message or third-party website is trustworthy.
- A temporary inbox is not a substitute for account security, a password manager, antivirus software or multi-factor authentication.
- Verification links can lead to third-party sites. Users should still check the destination and context before opening them.
- No Internet service can promise perfect availability or perfect protection against every future vulnerability.
Security reporting
Security concerns and suspected vulnerabilities can be reported through the official MailOnce Support channel at support@mailonce.org. Do not include passwords, session tokens, inbox tokens, device-link secrets or other live credentials.
Use verification messages with the right expectations
The Safe Email & Link Handling guide explains how MailOnce treats verification links and what users still need to judge for themselves.
Read Safe Email & Link Handling