How an Address Generator Works

Stage: the click that makes the address. In control: the service.

1. The generator assembles a string and stops there

An address generator does not build a mailbox for you. It picks a name, puts a domain behind it, and shows you the result. The entire operation is string assembly, which is the reason it finishes faster than the button finishes animating: nothing is provisioned, nothing is registered outside this service, and no other machine is asked for permission.

That is worth holding onto, because most of what people expect from the word generator belongs to other systems. It does not ask whether the form you are about to fill in will accept this domain. It does not confirm that anyone will ever write to the address. It produces a string that is valid under the rules of the standard and free inside this service, and everything else in that address's life happens somewhere you do not control.

2. The name is picked before the domain is attached

The left half of the address is chosen first, and there are three common ways to choose it. A random character string is the plainest: draw characters from an alphabet until the required length is reached. Two dictionary words joined together produce something a person can hold in their head for the ten seconds it takes to paste it. A pronounceable pseudo-random sequence sits in between, built from alternating consonant and vowel groups so it reads like a word without being one.

The three differ on three axes and only three. Length, which decides how many possible names exist. Readability, which decides whether you can dictate the address to somebody over a phone. And the size of the pool the name is drawn from, which decides how often two people are handed the same string. A short dictionary pair is comfortable and small. A long random string is awkward and enormous. That trade is the whole of the choice between a random name and one you type yourself.

3. The randomness underneath the name decides whether it can be reconstructed

A name is only unguessable if the numbers behind it are. Generators that build names from a clock reading, a request counter or a simple sequence produce output that looks scrambled and is not: anyone who knows roughly when the address was made can regenerate the candidates and try them. The scrambling was cosmetic, and the space of possibilities was never larger than the number of seconds in the window.

A name drawn from a cryptographic source does not have that property. There is no seed to guess and no ordering to exploit, so the only attack left is trying names one at a time against the service. That difference costs the generator nothing and changes what the address is worth, which is why it is the one internal detail of a generator that deserves your attention.

4. The domain comes out of a pool the service keeps

The right half is not invented. It is taken from a set of domains the service owns and points at its own mail server. Domains join that set and leave it, since a domain that has been handed out publicly for long enough ends up recognised, and recognised domains stop being useful for signup forms. Public domains are a consumable supply, and every disposable service spends them.

One domain is treated differently. The domain the site itself runs on is not handed out by default, because it is the first string anybody checks and the fastest of the set to be identified. Registered accounts get access to domains that are not published on the front page at all, which is most of what an account is for.

5. A row appears, and several things deliberately do not

What the click creates in the database is small: a record that this mailbox exists, when it expires, and which browser session it belongs to. That is the complete inventory.

What it does not create matters more. There is no password, because a guest mailbox is opened by knowing its address and nothing else. There is no profile, no verified owner and no account. Nothing about you was collected in order to produce the address, which is also why nothing about you can be returned to you if you lose it. A guest mailbox lives twenty four hours from the last time it was used, and asking for a new address deletes the old one and its contents on the spot. A free account raises those numbers: ten mailboxes at once, seven days from your last sign-in, and individual messages kept up to thirty days.

6. The address receives mail although it did not exist a minute ago

Mail reaches a freshly generated address because the mail server accepts mail for the entire domain rather than for a list of known names. There is no registration step to wait for and no propagation delay to sit through, which is why an address made ten seconds ago works.

7. The generator does not send, sign or pre-clear anything

Three things it will not do, stated plainly, because assuming otherwise wastes your time. It does not send mail: the mailbox receives and nothing else. It does not sign or authenticate anything on your behalf. And it does not test the address against the form you are heading for, so a rejection you meet later is information the generator never had. There is also no programmatic access, and that is a decision rather than a gap, with the reasoning set out in full.

The handover

The string exists and it is yours for as long as you keep using it, which is the last moment in this whole sequence where you are the one deciding anything. From here control passes outward: to the standard and the form that decides whether the address counts as valid at all, then to the site's server the instant you press submit on a signup form. And once you are finished with it, control passes to nobody, which is its own kind of problem and is covered in what happens when the same address comes back. If you want to watch the sequence start rather than read about it, the generator is one click away.