When the Same Address Comes Back

Stage: the address after you are done with it. In control: nobody.

1. A public disposable address belongs to nobody, including you

On a public disposable service an address is borrowed, not owned. While the mailbox is alive it is yours alone and nobody else can be handed it. Once the mailbox is gone the string returns to the pool, and the same combination of name and domain can be handed to somebody who has never heard of you.

This is the property that distinguishes a generated address from every other kind of address you use. There is no registrar, no ownership record and no renewal. The mailbox is a reservation with a timer on it, and the timer is the entire system of ownership.

2. Collisions are possible because the supply of names is finite

Names are drawn from a set, and any set can eventually repeat. The domains are shared by everybody using the service, so the only thing separating two people is the string on the left, and how often that string repeats depends on how long it is and how many characters it was drawn from.

Short names repeat sooner. Long random names built from a proper source repeat so rarely that the question stops being practical. Nothing else in the design moves this number: not the choice of domain, not the time of day, not how careful you are. Length is the whole lever, which is why the generator picks a long name by default.

3. The next holder sees only what arrives after the address reaches them

If somebody is later handed an address you used, they do not inherit your mail. On this service the mailbox is deleted with its contents: a guest mailbox goes twenty four hours after it was last used, and it goes immediately when you ask for a new address, taking every message with it. There is no archive underneath and no restore. The next holder starts with an empty box.

Say that plainly because the fear is usually the other way round. People picture a stranger reading last week's confirmation messages. That is not the failure mode here. The messages are gone, and the reason they are gone is that keeping them would be a far larger problem than losing them.

4. The risk sits in mail that has not been sent yet

The exposure is forward, not backward. If a service still holds that address as your contact, anything it sends tomorrow arrives in a mailbox belonging to somebody else. A password reset link is the sharp example: it is a working key, it is generated on request by whoever asks, and it lands in a box you no longer have.

Nobody has to be malicious for this to hurt. The new holder does not need to know who you are or care; they only need to be sitting in front of the mailbox when the message arrives. The address stopped being a private channel the moment your mailbox expired, and the account on the far end has no way of knowing that.

5. One rule follows from that, and it is the only rule here

An address that might receive something important tomorrow should not be a disposable one. That is the whole conclusion, and it is a rule about the future of the account rather than a list of forbidden categories.

Apply it at the moment you paste, not later. The question is not how sensitive the site feels, it is whether you would mind losing the ability to get back in. If the honest answer is yes, this is not the right kind of address, and the value of knowing that early is that it costs nothing.

6. The service works against collisions in three concrete ways

First, the default name is long, which pushes repetition far enough away to stop mattering. Second, asking for a new address deletes the previous mailbox immediately rather than leaving it to time out, so there is no window where an abandoned box sits around collecting mail. Third, a live mailbox is exclusive: as long as it is yours, nobody else is given that string.

A free account extends the same idea rather than changing it. Ten mailboxes at once, seven days from your last sign-in, messages held up to thirty days, and domains that are not published on the front page. It is more room, not different ownership. The address still returns to the pool at the end.

7. Three habits people try, none of which help

Reserving an address by generating it and coming back next week does not work, because the timer runs on use and the mailbox will be gone. Relying on a name being unusual does not work, because rarity is not the same as a large space, and the guessing was never done by hand anyway. Writing the address down and treating it as yours does not work either: the note in your file has no effect on the service, and a recorded address you cannot open is just a string.

If you find yourself doing any of the three, the situation has outgrown a disposable address. Either the task needs a real mailbox, or it needs an account where the mailboxes persist properly.

The handover

Once your mailbox expires, control passes to nobody at all, and that vacuum is the point of this page. What arrives next belongs to whoever holds the string, which is why the sites still holding it matter more than the address does. If one of them is waiting for you to click something, the confirmation link and what it proves explains why that click is time-limited by design. And if the reason you are cycling through addresses is volume rather than privacy, the ceiling you are about to hit is described in why mass signups do not work. A fresh mailbox, exclusively yours while it lasts, is one click from here.