tmailrPrivacy
One-time codes are not secret in transit
22 July 2026 · 2 min read · TMailr
The six digits in a verification email are treated as a second factor, and for the few minutes they exist they are the only thing standing between an attacker and an account. It is worth being precise about who can see them on the way.
Who touches the code
- The service that generated it, and whatever logging it does.
- Their sending platform, which is usually a third party with its own staff and its own logs.
- Every mail server on the path, each of which sees the whole message.
- Your mail provider, who stores it.
- Anything with access to your mailbox, including apps you granted read access to years ago.
TLS protects each hop against somebody watching the wire. It does nothing about the servers themselves, which handle the message in the clear by necessity: they have to read the headers to route it.
Which is why the window matters more than the digits
Six digits is a million possibilities, which is plenty against guessing if attempts are limited and useless if they are not. But the real defence is time. A code valid for five minutes is exposed for five minutes; one valid for a day sits in a mailbox all day, and mailboxes are where account takeovers start.
If you send codes: expire them in minutes, invalidate on first use, invalidate the previous one when a new is requested, and limit attempts per code rather than per session.
Do not put the code in the subject
It is convenient and it is visible on a lock screen, in a notification, and in the message list of a shared or shoulder-surfed device. Worse, subjects turn up in places bodies do not: sync logs, mail client search indexes, and the previews some tools generate.
The same goes for magic links, which are codes with better ergonomics and identical exposure. A link in an email is a bearer token in an inbox.
What this means for disposable addresses
A throwaway inbox is a perfectly reasonable place to receive a code for a service you will not return to. It is a poor place for one that guards anything, and for a specific reason: if knowing the address is enough to read the mail, the code is public.
That is the question to ask any disposable service. Ours will not open an inbox from the address alone; the secret is in the link. A service where you type an address and read its contents is fine for a download link and wrong for anything with a code in it.
The short version
- Treat a code as public from the moment it is sent, and make it worthless quickly.
- Minutes, not hours. Single use. Attempts limited.
- Keep it out of the subject line.
- Never send one to an inbox anybody can open by guessing its name.
More on privacy
