- Home
- Temporary email services
- SpamEater
On the recordRead 5 Oct 202623 facts
SpamEater
On the record
- Architecture
- The project uses Haraka SMTP, an Express API, SQLite storage, and a vanilla JavaScript frontend.github.com · read 5 Oct 2026
- Components
- SpamEater uses Haraka for SMTP, Express for its API, and SQLite for storage.github.com · read 5 Oct 2026
- Deletion
- Inboxes and mail are deleted after 24 hours with no recovery.github.com · read 5 Oct 2026
- Deployment
- The project offers Docker deployment and a native installer; the Docker setup requires Docker Engine 20.10 or later and Docker Compose v2 or later.github.com · read 5 Oct 2026
- Email privacy
- Email bodies are encrypted at rest with AES-256-GCM.github.com · read 5 Oct 2026
- Email rendering
- HTML email is adapted for the dark interface, inline images are embedded, and remote images stay blocked until loaded for that email.github.com · read 5 Oct 2026
- Encryption
- Email bodies are encrypted at rest with AES-256-GCM.github.com · read 5 Oct 2026
- Inbox lifetime
- Inboxes and their mail are deleted after 24 hours, with no recovery.github.com · read 5 Oct 2026
- Inbox privacy limit
- Anyone who knows an inbox name can read it, so the README recommends random names for mail users want to keep private.github.com · read 5 Oct 2026
- Intended use
- The README describes SpamEater as intended for throwaway mail and says not to point anything important at it.github.com · read 5 Oct 2026
- License
- The repository identifies SpamEater as MIT licensed.github.com · read 5 Oct 2026
- Limit
- Anyone who knows an inbox name can read that inbox, and the project recommends random names for inboxes users want to keep private.github.com · read 5 Oct 2026
- Mail transport
- Inbound SMTP is plaintext, while the web interface is HTTPS-only.github.com · read 5 Oct 2026
- Privacy
- The service has no user accounts, tracking, or analytics.github.com · read 5 Oct 2026
- Purpose
- SpamEater is self-hosted disposable email, with inboxes that delete themselves after 24 hours.github.com · read 5 Oct 2026
- Rendering
- The web interface adapts HTML email for dark mode and blocks remote images until the user loads them.github.com · read 5 Oct 2026
- Requirements
- Setup requires a domain, configured DNS, a static public IP, and open ports 25, 80, and 443.github.com · read 5 Oct 2026
- Security
- The project lists ModSecurity with the OWASP Core Rule Set, fail2ban, CSRF and HMAC delete tokens, and rate limiting across SMTP, WAF, and API layers.github.com · read 5 Oct 2026
