A different address for every site you sign up to.
closet-mail gives each website its own email alias. Mail reaches your real inbox, replies go out as the alias, and your real address stays in the closet.
Invite onlyAGPL-3.0Passkeys and TOTP
A shop sends a receipt
orders@shop.example
To the alias you gave them
river.lamp42 @closetcompute.onlineSpam check, trackers removed, banner added
score 1.2 · 2 trackers stripped
Lands in your inbox
you@your-real-inbox
Your inbox, with a front door you control.
You keep using the inbox you already have. closet-mail sits in front of it and decides what gets through.
- Step 1
Make an alias for each site
Generate one in a click, or name it yourself. Signing up somewhere new never needs your real address again.
- Step 2
Mail arrives in your normal inbox
Each forwarded message carries a small banner. It shows which alias was used and lets you block the sender in one click.
- Step 3
Reply without giving yourself away
Hit reply as usual. The shop sees the alias, never your real address. If an alias starts getting spam, turn it off.
Everything an alias needs, nothing it leaks.
Reply from Gmail. Arrive as the alias.
Your address is removed from the headers and the quoted text, and the banner is stripped before it leaves. Only your verified inboxes can reply, and they must pass DMARC.
Suspicious mail waits for you
Rspamd scores every message. Borderline mail is held, encrypted, for 7 days.
Make up aliases on the spot
Turn on catch-all and any address on your subdomain works the first time someone uses it.
Encrypted before it leaves
Upload a public key and forwarded mail is encrypted to it, subject line included if you like.
Passkeys and authenticator codes
Accounts are invite only. Add a passkey or a TOTP app, with backup codes for a bad day.
Read receipts you never agreed to, gone
Invisible tracking pixels and known tracking hosts are stripped from every forwarded message.
Server down? Your mail waits.
Mail is accepted and held at the edge, then delivered once the server is back. Unknown addresses are refused on the spot.
Block a sender, or a whole domain
From the banner, the dashboard or the blocklist. Turned-off aliases drop mail quietly.
Know when mail fails
Bounces and complaints show up under failed deliveries. A dead inbox is paused after three hard bounces.
Labels, search and bulk actions
Describe each alias, tag it, and switch a hundred off at once.
Make aliases from anywhere.
Every dashboard action is available over a REST API. Create tokens with only the permissions a script needs.
- Scoped tokens: aliases, recipients, contacts
- Optional expiry on every token
- Rate-limit headers on every response
curl -X POST https://app.closetcompute.online/api/v1/aliases \ -H "Authorization: Bearer ma_3fk2…" \ -d '{"format": "words", "description": "Bakery"}' # 201 Created { "address": "maple.otter17@closetcompute.online", "state": "active", "reply_enabled": true }
const res = await fetch("https://app.closetcompute.online/api/v1/aliases", { method: "POST", headers: { Authorization: `Bearer ${token}` }, body: JSON.stringify({ format: "words", description: "Bakery" }), }); const { address } = await res.json(); // "maple.otter17@closetcompute.online"
import httpx res = httpx.post( "https://app.closetcompute.online/api/v1/aliases", headers={"Authorization": f"Bearer {token}"}, json={"format": "words", "description": "Bakery"}, ) print(res.json()["address"]) # maple.otter17@closetcompute.online
Built so we can't read your mail.
Messages pass through and are deleted. What has to be stored is encrypted.
Nothing kept after delivery
A message is deleted from the buffer as soon as it is forwarded. Logs record counts and outcomes, never subjects, bodies or addresses.
Encrypted at rest
Real addresses, descriptions and quarantined mail are encrypted in the database. Nightly backups are encrypted too.
Open source
Every line is on GitHub under AGPL-3.0. Read it, audit it, or run your own copy.