Random Email Address Generator: Real Addresses That Work

A random email address generator can give you one of three different things: a fake address that looks real but receives nothing, a public temporary inbox that anyone can open, or a real alias that delivers to you for as long as you keep it. For any account you plan to log in to again, you want the third kind. Without a domain, that means an alias service. With a domain that has catch-all turned on, the generator on this page makes random addresses in your browser and sends nothing anywhere. CatchNone covers both cases on iPhone, iPad, and Mac: random @catchnone.com addresses with Premium, or random aliases on your own domain, with their mail read in its own app and each message badged with the address it reached.

Which kind of random address do you need?

Most sites that call themselves a random email generator make only one of these. Here’s how the three compare.

Fake-format tools are honest that their addresses receive nothing. IPVoid’s generator says its addresses “are fake (randomly generated) and cannot be used to receive emails,” yet its script builds them at gmail.com, yahoo.com, outlook.com, and other real providers, half of them in the firstname.surname pattern. Nothing checks whether a real person already owns one, so “fake” describes the intent, not the result.

If a signup sends a verification code, a fake address or anything at example.com will never receive it. You need a real inbox: a temporary one if you’ll never come back, an alias if you will.

Public inboxes trade privacy for convenience. Mailinator’s FAQ says “All emails are public. Any person can read anywhere,” and YOPmail inboxes have no password. Anyone who can open the inbox can also request a password reset for an account registered to it.

No domain? Free and low-cost email alias generators

These services give you a real, lasting random address with no domain, DNS, or mailbox to set up. Most forward it to the inbox you already use; CatchNone, the app behind this Journal, keeps that mail in its own app instead. Plans change often, so check the linked page before you choose. CatchNone has no connection with the other services in this table.

To get a @catchnone.com address:

1. In CatchNone, choose Use @catchnone.com and subscribe to Premium.
2. Create a new alias and give it a name, such as the site’s.
3. Select Create & Copy. The service assigns a random address, such as abcde-12345@catchnone.com, and copies it for the signup form.
4. To stop one later, switch it off. Senders then get a bounce, and your other addresses keep working.

If you already pay for iCloud+, Hide My Email is built in. For a closer look at how these services differ on replies, custom domains, and what happens when you leave, see email alias services compared.

Random email generator that works: why some addresses fail

If a random address fails at signup, check these four things.

• It was never real. A fake-format address has no mailbox behind it. Use a real alias instead, or a public inbox for a one-off.
• The domain is blocked. The public disposable-email-domains blocklist, which PyPI says it uses to block registrations, listed 8,971 domains on September 25, 2026, including mailinator.com, yopmail.com, guerrillamail.com, and generator.email. YOPmail offers a new alternate domain every day because sites keep blocking its addresses. Use an alias service or your own domain instead.
• The site refuses alias addresses. Alias domains such as duck.com, mozmail.com, simplelogin.com, and anonaddy.me were not on that list, but Relay’s FAQ notes that some sites reject addresses on a subdomain, and some now accept only Gmail, Hotmail, or Yahoo. Try another alias service or your own domain. If a site takes only the big providers, you may have to give it your main address.
• Catch-all is off. On your own domain, a random address arrives only if the domain accepts mail for addresses you never set up. With an iCloud+ custom email domain, for example, that mail is “returned to the sender” unless Allow All is on. Turn it on first (steps below).

Random email address generator for your own domain

If you own a domain, you don’t need an alias service to make random addresses. Any valid string before the @ (up to 64 characters) works, as long as the domain delivers mail for every address, which is what a catch-all does. Turn it on first:

• Cloudflare Email Routing: go to Compute → Email Service → Email Routing → Routing Rules, turn on the Catch-all rule so it shows as Active, choose an action, and select Save (Cloudflare’s steps). The full setup is in using Gmail with a custom domain through Cloudflare.
• iCloud+ Custom Email Domain: at icloud.com/icloudplus, select Custom Email Domain, select your domain, then select Turn On Allow All (Apple’s steps). Only the domain owner can do this.
• Other hosts: set up a catch-all on Google Workspace, cPanel, Zoho, and others.

Then set the options below. The generator runs in your browser, makes no network requests, and saves nothing. It draws characters with crypto.getRandomValues, not Math.random() (which IPVoid uses and MDN says “does not provide cryptographically secure random numbers”). It uses lowercase letters and digits only, because RFC 5321 says relying on case before the @ “is discouraged,” and it stays within the 64 characters the same standard allows there.

Leave the domain as example.com and you get dummy addresses for test data that can never receive mail (see dummy email addresses for testing). Type your own domain for addresses you’ll really use, and send a test message to one of them before you use it for a signup. If it doesn’t arrive, catch-all isn’t on yet, or your provider filed the message as spam.

How random is random enough?

For an address you give one site, 8 random lowercase letters and digits is plenty: with the Standard look-alike filter, that’s 39.6 bits, or about 850 billion possible addresses. Past that, each extra character mostly adds typing. What randomness can and can’t do depends on which of two threats you have in mind.

Someone guessing your address

If your addresses follow a pattern like shop@example.com, anyone who sees one can guess the rest. Random characters close that gap, and bits of randomness measure how well: each extra bit doubles the number of possible addresses. On a catch-all domain every guess is delivered anyway, so randomness doesn’t keep mail out. What it buys you is that nobody can work out the address you gave one site from another one, so mail to it came from that site or from someone it shared the address with.

The table gives total bits for each length, assuming lowercase letters and digits and the same look-alike filters as the generator above.

The look-alike filters give up a little randomness per character so nobody confuses 0 with o.

Words are the other trade-off. A word picked at random from the EFF’s 7,776-word list adds about 12.9 bits, so three random words (about 38.8 bits) roughly match eight random characters. DuckDuckGo’s new addresses and Fastmail’s Masked Email also use words, but that figure is for the EFF list, not theirs.

Spam sent to made-up addresses

Randomness does nothing against the second threat. The FTC’s CAN-SPAM guide describes a dictionary attack as “sending email to addresses made up of random letters and numbers in the hope of reaching valid ones,” and on a catch-all domain every one of those addresses is valid. That’s a problem for your catch-all rules and filters, not your naming; what a catch-all address is and why it attracts spam covers the options.

Readable or random: naming addresses per site

Random isn’t the only sensible choice. Each style has a cost.

Gmail also ignores dots in consumer @gmail.com addresses, so j.ohn.smith reaches johnsmith. That’s deliverable, but as easy to undo as a plus tag. A random string at gmail.com, on the other hand, is either nobody’s address or someone else’s. More on tags and which providers support them in plus addressing.

Whichever style you pick, keep a record of where each address went.

Random email address and password together: password managers

A password manager can make the address and the password together and save both with the login. That’s the real version of an “email and password” generator: a fake address plus a random password from a generator site isn’t an account you can use.

Bitwarden: catch-all usernames

These steps follow Bitwarden’s generator help as of September 2026. You need your own domain with catch-all on.

1. Open the generator. In the web app, go to Tools → Generator and select Username. In the browser extension, open the Generator tab and choose Username. You can also select the Generate icon in the Username field of a login you’re editing.
2. From the Type menu, choose Catch-all email. The other types are Random word (the default), Plus addressed email, and Forwarded email alias.
3. Enter your domain in Domain.
4. Generate, then copy the address or save it with the login. Bitwarden’s open-source client makes 8 random characters by default, like bqzjlero in Bitwarden’s own example.

In browser extensions and desktop apps, the Add/Edit item screen can instead build the address from the site’s name, such as Instagram.com@example.com, which is readable but guessable.

Bitwarden: forwarded aliases

Bitwarden’s Forwarded email alias type instead creates the alias in an outside service, such as SimpleLogin, addy.io, Firefox Relay, Fastmail, Forward Email, or DuckDuckGo, once you paste that service’s API key into the generator. Support varies by Bitwarden app, so check Bitwarden’s generator help first.

1Password and Fastmail

If you searched for a masked email generator, Fastmail’s Masked Email is the product with that name. Its addresses are random words plus a random number, like dog.food3495 before the @. You create them in Fastmail at Settings → Masked Email → New Masked Email address, or straight from the 1Password browser extension. Fastmail has no free plan, only a trial of up to 30 days (as of September 2026). More in Fastmail Masked Email on a custom domain.

Do random addresses expire?

Fake-format addresses never worked, and public inboxes keep mail only briefly. If you want a permanent random address, use an alias service or your own domain. As of September 2026:

• CatchNone: an address lasts until you delete it. If Premium ends, your @catchnone.com addresses stay reserved, though mail to them is deleted on arrival until you subscribe again and open the app. Aliases on your own domain keep working on every plan.
• Fake-format addresses: nothing to expire; they never received mail.
• Mailinator: public messages last “a few hours.” Every address there already exists, and anyone can use it.
• Guerrilla Mail: messages are deleted after an hour, but the address stays available and you can switch back to it later.
• YOPmail: inboxes are never deleted, but messages are kept for 8 days, and anyone can open the inbox.
• generator.email: an address keeps receiving “for as long as its domain is active here.”
• DuckDuckGo: private addresses don’t expire while your account is active and you haven’t deactivated them.
• Firefox Relay: if you leave Premium, masks on your custom subdomain keep forwarding, but you can’t create new ones there or reply (Relay’s FAQ).
• SimpleLogin: if a paid plan ends, existing aliases keep receiving and sending; you just can’t create new ones over the free limit.
• addy.io: if a paid plan ends, aliases on paid-only domains and shared-domain aliases beyond the free 10 are deactivated (addy.io’s FAQ).
• Hide My Email: Apple says you lose access to it when you downgrade to the free iCloud plan, and doesn’t say what happens to existing addresses.
• Your own domain: an address lasts as long as you renew the domain and keep catch-all on. With catch-all on, an address you stop using keeps receiving. To block one, add a rule for that address at your provider; in Cloudflare Email Routing, that’s a routing rule with the Drop action.

Is it safe to use a random email address generator?

Generating a string is harmless. What you do with it decides the risk.

• Fake-format output: don’t sign up with it. It may be a real person’s address at gmail.com or yahoo.com, and you’ll never see the confirmation or reset email.
• Public inboxes: treat everything that arrives as published, and never use one for an account you keep, anything with your name on it, or a purchase.
• Alias services: they handle your mail, so pick one whose privacy policy you’re comfortable with, and check what happens to your addresses if you stop paying.

Dummy email addresses for testing

For test data, sample forms, and documentation, don’t generate anything at a real provider. Use the names reserved for exactly this, in RFC 2606 and RFC 6761:

• example.com, example.net, example.org: reserved for documentation, and not available for registration. On September 25, 2026, each published a null MX record, which under RFC 7505 means the domain accepts no email.
• .example: a reserved top-level domain for documentation and examples.
• .test: reserved for testing. RFC 6761 notes it may resolve differently on different networks, so you can point it at a mail catcher on your own network.
• .invalid: for names that are obviously invalid; lookups should fail immediately.

.localhost is reserved too, but it means your own machine, not a mail domain.

So user001@example.com is a safe entry for a test database, and qa@mail.test works with a local mail catcher. Neither will ever receive a verification code from the internet. To test a real signup code or password reset, use an inbox you control, such as a plus address on your own mailbox.

Avoid lookalikes. Only the reserved names are guaranteed not to belong to anyone: email.com has MX records pointing at mail.com’s servers, and testmail.com has no MX but does have an address record, so mail servers may still try to deliver there. And don’t fill a test database with random @gmail.com addresses; some of them belong to real people. If you generate test addresses in code, pair a cryptographic random source with a reserved domain.

Where CatchNone fits

CatchNone gives you real random addresses that keep working until you delete them, with their mail in its own app instead of your main inbox. With Premium, it assigns random @catchnone.com addresses such as abcde-12345@catchnone.com, with no domain, DNS, or mailbox to set up; switch one off and senders get a bounce. On a domain you own, it generates random aliases from the same kinds of format options as the generator above (the default looks like a2b3-c4dv), or you type one with Customize. It reads the mailbox your catch-all delivers to straight from your device, read-only over IMAP or JMAP, so that mail never passes through CatchNone’s servers. Every message is badged with the alias it reached, so a leaked or sold address shows up. The Free plan covers up to 10 aliases on your own domain; Lite and Premium have no limit there. Download CatchNone, available for iPhone, iPad, and Mac.

CatchNone is receive-only, so signup mail stays in its own app and you reply from your usual account. Each @catchnone.com message is kept for 30 days after it arrives. For test data, a reserved domain is still the right tool. See how CatchNone works.

FAQ

Can I get a random email address with an inbox?

Yes, in two ways. A public inbox such as Mailinator or YOPmail works instantly, but anyone who knows the address can read it. An alias is private to you: CatchNone gives its @catchnone.com addresses an inbox of their own in the app, while DuckDuckGo, Firefox Relay, or SimpleLogin deliver to the inbox you already have.

Can a fake email address be traced?

The address is rarely what gives you away. Whatever you type into a signup form, the site still sees how you connect and any payment details you give it. A random alias keeps your main address away from a site, but it doesn’t hide who you are, and the alias service sees the mail it passes on.

How do I make a list of dummy email addresses?

Leave the generator’s domain as example.com, generate, and select Copy all. Or number them yourself: user001@example.com, user002@example.com, and so on.