SpamEater
SpamEater is a free, open-source disposable email service that you host on your own domain and server.
What SpamEater is
SpamEater is a free, open-source disposable email service that you host on your own domain and server. It creates inboxes without user accounts, and deletes each inbox and its mail after 24 hours with no recovery. The project describes it as intended for throwaway mail, not important messages. Email bodies are encrypted at rest with AES-256-GCM. The web interface adapts HTML email for dark mode, embeds inline images, and blocks remote images until loaded. The web interface is HTTPS-only, but inbound SMTP on port 25 is plaintext. Anyone who knows an inbox name can read it, so the project recommends random names for inboxes meant to stay private. Its listed protections include ModSecurity with the OWASP Core Rule Set, fail2ban, CSRF and HMAC delete tokens, and rate limiting. Deployment options include Docker and a native installer. Setup requires a domain, configured DNS, a static public IP, and open ports 25, 80, and 443; Docker also requires Docker Engine 20.10 or later and Docker Compose v2 or later. The repository identifies the project as MIT licensed.
Good
- No user accounts, tracking, or analytics.
- Email bodies are encrypted at rest.
- Offers Docker and native installer deployment.
- Supports custom domains and API access.
Watch out
- Inboxes and messages are deleted after 24 hours without recovery.
- Anyone who knows an inbox name can read it.
- Inbound SMTP on port 25 is plaintext.
- Setup requires a domain, DNS, static IP, and open ports.
Who it suits
SpamEater suits people who can manage their own domain and server and need disposable inboxes for throwaway mail. It is not suited to important messages, which the project advises against routing through it.
Verdict
SpamEater offers self-hosted disposable inboxes with a fixed 24-hour lifetime and no account system. Its setup requirements, inbox-name privacy limit, and plaintext inbound SMTP are important considerations.
The facts
Each one read from SpamEater's own pages, with the date it was checked.
What it does
- Architecture
- The project uses Haraka SMTP, an Express API, SQLite storage, and a vanilla JavaScript frontend.checked 5 Oct 2026
- Components
- SpamEater uses Haraka for SMTP, Express for its API, and SQLite for storage.checked 5 Oct 2026
- Deletion
- Inboxes and mail are deleted after 24 hours with no recovery.checked 5 Oct 2026
- Deployment
- The project offers Docker deployment and a native installer; the Docker setup requires Docker Engine 20.10 or later and Docker Compose v2 or later.checked 5 Oct 2026
- Email privacy
- Email bodies are encrypted at rest with AES-256-GCM.checked 5 Oct 2026
- Email rendering
- HTML email is adapted for the dark interface, inline images are embedded, and remote images stay blocked until loaded for that email.checked 5 Oct 2026
- Encryption
- Email bodies are encrypted at rest with AES-256-GCM.checked 5 Oct 2026
- Inbox lifetime
- Inboxes and their mail are deleted after 24 hours, with no recovery.checked 5 Oct 2026
- Inbox privacy limit
- Anyone who knows an inbox name can read it, so the README recommends random names for mail users want to keep private.checked 5 Oct 2026
- Intended use
- The README describes SpamEater as intended for throwaway mail and says not to point anything important at it.checked 5 Oct 2026
- License
- The repository identifies SpamEater as MIT licensed.checked 5 Oct 2026
- Limit
- Anyone who knows an inbox name can read that inbox, and the project recommends random names for inboxes users want to keep private.checked 5 Oct 2026
- Mail transport
- Inbound SMTP is plaintext, while the web interface is HTTPS-only.checked 5 Oct 2026
- Privacy
- The service has no user accounts, tracking, or analytics.checked 5 Oct 2026
- Purpose
- SpamEater is self-hosted disposable email, with inboxes that delete themselves after 24 hours.checked 5 Oct 2026
- Rendering
- The web interface adapts HTML email for dark mode and blocks remote images until the user loads them.checked 5 Oct 2026
- Requirements
- Setup requires a domain, configured DNS, a static public IP, and open ports 25, 80, and 443.checked 5 Oct 2026
- Security
- The project lists ModSecurity with the OWASP Core Rule Set, fail2ban, CSRF and HMAC delete tokens, and rate limiting across SMTP, WAF, and API layers.checked 5 Oct 2026
- Security protections
- The project lists ModSecurity with OWASP Core Rule Set, fail2ban, CSRF tokens, HMAC delete tokens, and rate limiting across SMTP, WAF, and API layers.checked 5 Oct 2026
- Setup
- It runs on a domain and server you own and requires no user accounts.checked 5 Oct 2026
- Support
- The repository says to report vulnerabilities through its GitHub Security tab.checked 5 Oct 2026
- Supported systems
- The native installer lists AlmaLinux, RHEL, and Rocky Linux 9 and 10, plus Ubuntu 22.04 or later and Debian 11 or later.checked 5 Oct 2026
- Web transport
- The web interface is HTTPS-only, while inbound SMTP on port 25 is plaintext.checked 5 Oct 2026
Alternatives to SpamEater
- 1
EmailOnDeck
Free planAndroidiOSWebAPI8.1Free plan - 2
Guerrilla Mail
Free planOpen sourceAndroidWebAPIExtension8.1From $9.99 a year - 3
Mailinator
Free planAndroidWebAPIExtension7.8From $79 a month - 4
SecureTempMail
Free planWebAPIExtensionLinux7.8From $39 a year - 5
Mohmal
Free planWeb7.5From $35.99 a year - 6
MailDrop
Free planWebAPI7.4From $5 a month