Test outbound email without
touching a real inbox
TempMailer is a self-hosted sandbox mail-trap: real SMTP in, full preview and inspection out. Isolated per credential, built for teams.
Everything a mail sandbox should have
Built for QA, staging environments, and anyone who doesn't want test emails landing in a real customer's inbox.
Isolated mailboxes
Every credential is its own sandbox inbox. Mail sent under one set of SMTP credentials never leaks into another.
AI & MCP Connector
Direct, secure HTTP endpoint for AI assistants and MCP tools to read mailbox emails, fetch OTP codes, and inspect test payloads.
Device previews
View every message as it would render on desktop, tablet and mobile before it ever reaches a real inbox.
Compatibility checker
A heuristic scan flags flexbox, grid, web fonts, and other markup that trips up Outlook, Gmail and friends.
SMTP + REST API
Every mailbox ships with both real SMTP credentials and a REST API key, ready to plug in from a script or an app.
Tenant isolation
Admins and their users are fully walled off from every other admin's workspace. No cross-tenant access, ever.
Team accounts
Admins provision their own users and hand out mailbox access, with no shared logins and no guesswork.
Temporary mail sharing
Share single captured emails with teammates or external QA via secure, auto-expiring 2-hour links, with optional passcode protection.
Synthetic test sender
Drop mock messages straight into any sandbox inbox directly from the UI or API to test rendering without an external SMTP client.
How it works
Get a mailbox
An admin creates a credential, a sandbox mailbox with its own SMTP login and API key.
Point your app at it
Swap your app's outbound SMTP settings for the sandbox host, port, and that mailbox's credentials.
Send as usual
Your app sends mail exactly like it would in production. Nothing reaches a real inbox.
Inspect and iterate
Open the message in TempMailer: preview, raw HTML, headers, and the compatibility report.
Isolation you can trust
Every admin's workspace, including their users, mailboxes and mail, is scoped and checked on every request. Nothing crosses tenant boundaries, by design.
- Rate-limited login, registration and OTP endpoints
- Server-validated requests on every public-facing form
- Non-sequential message IDs, so guessing another mailbox's mail isn't possible
- Email-verified signups, approved by an administrator before access
Frequently asked questions
Ready to stop testing in production inboxes?
Create an account, and an administrator will grant you access once it's verified.