A real Gmail address, temporarily

Gmail treats dots in an address as insignificant and ignores anything after a + when deciding which mailbox to deliver to. So a single mailbox — yourname@gmail.com — also receives mail addressed to your.na.me+8fk2p9@gmail.com. Geek Mails generates one of those variations for you, records which variation belongs to which visitor, and shows you only the mail addressed to yours.

An address therefore costs nothing to create. There is no provisioning step and no mail server to run: creating your address is a database row, which is why it appears the instant you press the button.

1. The message is delivered to Gmail. It arrives in the mailbox behind your address, exactly as any other mail to that account would.
2. A worker fetches it over IMAP. A separate background process polls the connected mailbox every few seconds, parses new messages, and matches each recipient address back to the visitor it was issued to.
3. It is stored and shown to you. The sender, subject, date and body are saved, and the message appears in your inbox on the homepage — no refresh required, though there is a button if you are impatient.
4. It is rendered safely. Scripts are stripped, the message is displayed in a sandbox that cannot execute code, and remote images stay blocked until you ask for them, so a tracking pixel cannot confirm you opened it.

Sites that reject disposable addresses do it by checking the domain after the @ against a public blocklist of throwaway-mail providers. Because your address is on gmail.com, that check passes — no blocklist can include Gmail without breaking most of the internet.

This is not a guarantee, and we would rather say so than oversell it. A form that refuses any address containing a + will still refuse yours, and any site may reject any address for reasons of its own. If that happens, generating a new address is often enough. Why signup forms reject temporary addresses goes through the detection methods in detail.

There is no account, so there is nothing to log into and nothing to steal. Your claim on your address is a signed cookie called gm_inbox, set by the server and marked httpOnly so that scripts on the page cannot read it. It holds an internal reference to your address and nothing else.

Your address never appears in a URL, and the server refuses to answer for any inbox but the one your cookie names — so there is no id to guess and no link that would expose someone else's mail. The direct cost of that design is that the cookie is the only thing linking you to your inbox: clear it, switch browsers, or use a private window, and the address is gone from your side with no way to restore it.

• Receive only. You cannot send, reply to, or forward mail from an address issued here.
• Operators can read your mail. Messages are stored in readable form and an administrative console can list and read them. The privacy policy sets out exactly what is kept.
• Google is in the path. The mailboxes are Gmail accounts, so mail sent to you passes through and is retained by Google under their terms.
• No automatic expiry, and no guarantees. Messages are not deleted on a timer today, but nothing promises your address or its mail will exist tomorrow either.
• Not for anything that matters. No banking, identity, medical, or account-recovery mail. See the terms.

There is no signup step to describe. Open the inbox, press Create my address, and paste the result wherever you need it. The FAQ answers what happens next.