Skip to content
SPECIFICTION
Get listed

SpamEater

github.com

WebLinuxAPISelf-hosted
Visit github.com
Spec score 7.4 #17 of 25 in Disposable Email Services

Spec sheet

Purpose
SpamEater is self-hosted disposable email, with inboxes that delete themselves after 24 hours.Read 5 Oct 2026 · github.com
Deployment
The project offers Docker deployment and a native installer; the Docker setup requires Docker Engine 20.10 or later and Docker Compose v2 or later.Read 5 Oct 2026 · github.com
Security
The project lists ModSecurity with the OWASP Core Rule Set, fail2ban, CSRF and HMAC delete tokens, and rate limiting across SMTP, WAF, and API layers.Read 5 Oct 2026 · github.com
Privacy
The service has no user accounts, tracking, or analytics.Read 5 Oct 2026 · github.com
Support
The repository says to report vulnerabilities through its GitHub Security tab.Read 5 Oct 2026 · github.com
License
The repository identifies SpamEater as MIT licensed.Read 5 Oct 2026 · github.com
Architecture
The project uses Haraka SMTP, an Express API, SQLite storage, and a vanilla JavaScript frontend.Read 5 Oct 2026 · github.com
Components
SpamEater uses Haraka for SMTP, Express for its API, and SQLite for storage.Read 5 Oct 2026 · github.com
Deletion
Inboxes and mail are deleted after 24 hours with no recovery.Read 5 Oct 2026 · github.com
Email privacy
Email bodies are encrypted at rest with AES-256-GCM.Read 5 Oct 2026 · github.com
Email rendering
HTML email is adapted for the dark interface, inline images are embedded, and remote images stay blocked until loaded for that email.Read 5 Oct 2026 · github.com
Encryption
Email bodies are encrypted at rest with AES-256-GCM.Read 5 Oct 2026 · github.com
Inbox lifetime
Inboxes and their mail are deleted after 24 hours, with no recovery.Read 5 Oct 2026 · github.com
Inbox privacy limit
Anyone who knows an inbox name can read it, so the README recommends random names for mail users want to keep private.Read 5 Oct 2026 · github.com
Intended use
The README describes SpamEater as intended for throwaway mail and says not to point anything important at it.Read 5 Oct 2026 · github.com
Limit
Anyone who knows an inbox name can read that inbox, and the project recommends random names for inboxes users want to keep private.Read 5 Oct 2026 · github.com
Mail transport
Inbound SMTP is plaintext, while the web interface is HTTPS-only.Read 5 Oct 2026 · github.com
Rendering
The web interface adapts HTML email for dark mode and blocks remote images until the user loads them.Read 5 Oct 2026 · github.com
Requirements
Setup requires a domain, configured DNS, a static public IP, and open ports 25, 80, and 443.Read 5 Oct 2026 · github.com
Security protections
The project lists ModSecurity with OWASP Core Rule Set, fail2ban, CSRF tokens, HMAC delete tokens, and rate limiting across SMTP, WAF, and API layers.Read 5 Oct 2026 · github.com
Setup
It runs on a domain and server you own and requires no user accounts.Read 5 Oct 2026 · github.com
Supported systems
The native installer lists AlmaLinux, RHEL, and Rocky Linux 9 and 10, plus Ubuntu 22.04 or later and Debian 11 or later.Read 5 Oct 2026 · github.com
Web transport
The web interface is HTTPS-only, while inbound SMTP on port 25 is plaintext.Read 5 Oct 2026 · github.com

Where Specifiction places it

Alternatives to SpamEaterAll alternatives →