Guerrillamail.com

Choose a name or receive a random address

A visit creates a random address, while the provider also says users can choose their own email address. The service describes itself as a disposable temporary email address service in its Terms.

For users bringing a domain, Guerrilla Mail says they can use one they own, with arriving mail set to be accessible only to them or shared with everyone. The provider describes the service as protection from spam; this is its claim, not an independently verified result.

The provider says its email is powered by the open-source Go-Guerrilla project and that the website is accessible only through HTTPS encryption. Its cookie disclosure describes a session cookie, possible preference cookies, and third-party cookies.

Custom-domain access carries an annual fee

The provider lists custom-domain email service at $9.99 USD per year on its homepage, About page, and Terms, all checked on 2026-10-31.

For payment, the vendor names Bitcoin and PayPal on those same pages, including in the Terms.

The API keeps email access in a session

Guerrilla Mail documents a public JSON API over HTTP, with results returned as JSON-encoded strings. To maintain session state, clients must retain and send the PHPSESSID cookie, and the documentation says only emails owned by the current session ID can be fetched.

Each API request must include the function, end-user IP, and user-agent parameters. A client then receives JSON results; fetched email bodies have HTML filtered, including scripts, applets, and iframes.

The API’s `check_email` function returns a maximum list of 20 messages, according to the API documentation checked on 2026-10-31. The documentation also describes an extension function that can extend an email address by one hour, with a maximum extension of two hours.

Check setup and connections before relying

Before adopting the service in a workflow, ask the provider what setup is required and which integrations or connections it supports. These details affect how much work is needed to route email into an existing process.

If the workflow depends on programmatic access, ask whether the documented API supports its intended use. Clarify how the client will preserve the required session state and handle returned messages before relying on it.

Address choice and API access are documented

The provider describes two address paths: a random address on visiting the site, or an address chosen by the user. That gives the stated service more than one way to begin receiving mail, without requiring registration for the random-address path.

For users with a domain, the vendor documents using an owned domain and choosing whether arriving mail is accessible only to them or shared with everyone. The public HTTP JSON API and its session requirements are also documented, giving developers a described route to programmatic email access.

The provider states that the website is accessible only through HTTPS encryption. Its stated spam-protection purpose is relevant to disposable-email use, though it remains a vendor claim rather than an independently verified outcome.

Expiry and session rules constrain use

The provider’s About page, API documentation, and Terms, checked on 2026-10-31, describe limits on retention, access, and use.

• Inbox email is deleted after 1 hour, making the documented retention window short.
• Anyone who knows an inbox ID may access that inbox, so access depends on keeping the ID private.
• The vendor says an API session can expire after about 18 minutes of inactivity.
• The API may be rate limited; the documentation does not publish its rate limits.
• The API documentation cautions against checking email too frequently to avoid overloading the server.
• The Terms say the service is provided without express or implied warranties and disclaim responsibility for third-party resources and message content.

Several details are missing; they are listed under What we could not confirm.

Short-lived receiving fits the stated scope

The stated scope suits a task that needs temporary email access rather than a lasting mailbox. The provider says addresses expire after 60 minutes, and inbox email is deleted after 1 hour.

Access also has an exposure condition: anyone who knows an inbox ID may open that inbox. For workflows involving sensitive messages or requiring durable, controlled access, those conditions should be weighed before use.

Compare inboxes by access and retention

When comparing temporary inbox services, assess whether users can choose an address, how access is granted, and how long messages remain available. Also check whether outgoing mail is supported and what an API requires.

For work that depends on a custom domain or programmatic access, compare setup requirements and paid terms alongside retention. These criteria help distinguish short-term receiving from a mailbox intended for continued use.

Questions about the inbox and API

When does an address or inbox expire?

The provider says temporary email addresses last 60 minutes, while delivered inbox email is deleted after 1 hour. The API documentation also describes an extension function that can extend an address by one hour, with a maximum extension of two hours.

Who can access an inbox?

The provider says anyone who knows an inbox ID may access that inbox. The API documentation separately says clients must retain and send the PHPSESSID cookie, and that only emails owned by the current session ID can be fetched.

What does the API return when checking email?

The API documentation says `check_email` returns a maximum list of 20 messages. It also describes fetched message bodies as HTML-filtered, including scripts, applets, and iframes.

What happens if an API session is inactive?

The provider says an API session can expire after about 18 minutes of inactivity. Its documentation also advises clients not to check email too frequently, to avoid overloading the server.

How does the provider handle support requests?

The provider asks users to contact it through Facebook or Twitter in English and says it cannot always reply. The API documentation lists a support email for developers who created a Guerrilla Mail app.

What do the Terms say about outgoing email?

The Terms state that outgoing email will include an X-Originating-IP header with the listed address. They also prohibit sending spam, abusive or illegal content, malicious software, fraud, phishing, and other listed misuse.

Use it only when the short window fits

Fits if… the task needs temporary receiving and the stated retention window works for it.

Probably not if… the workflow requires durable inbox access or an inbox that stays private when its ID is known.

Main risk… the short retention and inbox-ID access model may not suit messages that need continued or restricted access. Check those conditions against the intended workflow before relying on the service.

Sources

The facts above were taken from the public pages listed here, and each entry shows the date it was read.

• www.guerrillamail.com/aboutchecked 2026-10-31
• www.guerrillamail.comchecked 2026-10-31
• www.guerrillamail.com/toschecked 2026-10-31
• www.guerrillamail.com/GuerrillaMailAPI.htmlchecked 2026-10-31

How we put this page together

Editorial team of Stack Shelf. Prepared by the editorial team of Stack Shelf from the public sources listed above; the facts were checked on 2026-10-31. Nobody tried the service in practice. We revise the text whenever those sources are updated.

Last updated: 2026-10-31

Right of reply

If you represent Guerrillamail.com and think this entry is inaccurate or out of date, write to us and attach evidence. After the refutation is documented, the entry is corrected or removed. Entries are not removed or toned down in exchange for money.

Our contact for replies

No data available

Response time

No data available

Also covered in Disposable email: neighbouring reviews

• Dropmail.me — Disposable email
• Mail.tm — Disposable email
• Tempinbox.xyz — Disposable email