One-time codes are not secret in transit
22 July 2026 · 4 min read
Email is store and forward. Your code sits, in the clear, on every machine that handles it, for as long as each keeps logs. TLS between hops helps only when every hop uses it, and it is opportunistic by default.
What follows from that
- Short expiry is not a formality. It is most of the protection.
- Single use matters more than length.
- A code in a subject line is visible in notification previews and in more logs.
- A magic link is a bearer token. Anyone who has it is you.
If you are building the sending side: expire in minutes, invalidate on use, never include the code in the subject, and do not log the message body. If you are receiving one on a shared or temporary address, use it and move on.
More on privacy
Most disposable email is not private at all
On many throwaway-mail sites, anyone who types your address can read your inbox. That is not a bug in those products, it is how they are built.
What a masked email alias actually does
An alias is not a second mailbox. It is a valve on your real one, and understanding the difference tells you when it helps and when it does not.
Plus addressing: useful, and easier to strip than you think
you+shop@gmail.com is a fine way to label mail and a poor way to hide anything.