Your custom address
Any available name on @inbox.my — 2 to 30 characters, letters, numbers, dot, dash and underscore. Short and clean, because the good ones have not been taken yet.
Home/Features
FeaturesOne plan. Everything in it.
There is no security tier, no storage upsell and no feature held back for a plan above yours. Annual and Lifetime buy the same mailbox — the only difference is whether it has a renewal date.
50 GBEncrypted mail & file storage
∞Aliases and catch-all rules
0Ad scans, ever
0Identity documents required
The mailbox
What you get, item by item
Zero-knowledge encryption
Argon2id derives your master key in the browser. Per-object AES-256-GCM data keys wrap under it. We store ciphertext and verifiers — never anything that could decrypt them. Details →
Unlimited aliases
A distinct address per service, all landing in one mailbox. When an alias starts getting spam you know exactly which company leaked it — and you kill that alias, not your address.
Spam stopped at the gateway
Rspamd scores every inbound message before it is encrypted at rest — DNS blocklists, SPF and DKIM results, Bayesian analysis, URL reputation. High scores are rejected outright, borderline ones quarantined.
IMAP, SMTP and webmail
Use the browser client, or point Apple Mail, Outlook, Thunderbird, K-9 or anything else at our servers over TLS. No proprietary bridge to install, no protocol lock-in.
PGP key import
Import a contact's public key and mail to them is genuinely end-to-end encrypted, not just TLS in transit. Publish your own key so people can write to you the same way.
Encrypted file storage
The 50 GB is shared between mail and files. Upload, encrypt and share with a link rather than sending 40 MB attachments that half of all mail servers will reject anyway.
No phone, no ID, no KYC
Nothing verifies who you are, because nothing needs to. One contact address to receive credentials, a crypto payment, and you are running. No SMS code, no passport scan, no selfie.
Monitored deliverability
Aligned SPF, DKIM and DMARC at p=reject, dedicated sending ranges checked against blocklists, MTA-STS in enforce mode. What that does and doesn't buy →
Aliases in practice
The feature that pays for itself in year one
Give every company a different address. When one of them leaks, sells or gets breached, the spam arrives at an address only that company ever had — and you learn who did it, then switch that single alias off.
Your real address stays clean and permanent. This is the single most effective thing you can do about inbox hygiene, and it is impossible on a free provider that gives you one address and a folder called Promotions.
- Tagged aliases —
[email protected], created by simply using them. - Opaque aliases — a random string that reveals nothing about your real address.
- Per-alias kill switch — disable one and mail to it is rejected at the gateway, not silently binned.
- Send as an alias — reply from the address they know you by, not the one you actually use.
alias use state
you+bank 12 msgs active
you+netflix 8 msgs active
you+conference24 3 msgs active
you+shop-xyz 441 msgs disabled
^ sold it
y4k2x9@inbox.my 19 msgs active
^ opaque
one leak. one alias off. real
address never touched.
Not included
Things we deliberately do not do
A feature list is only useful if it also says what is missing.
Custom domains
Not on these plans. The value here is the @inbox.my domain itself and the sending reputation we manage on it centrally.
Bulk & marketing sending
Prohibited, and enforced automatically. One bulk sender degrades placement for everyone on the domain. Policy →
Calendar, contacts, docs
Not yet. We would rather ship one mail product that works than four that half-work. Storage and mail are the scope today.
Password recovery
Impossible by design. Losing your passphrase means losing the mail — recovery keeps the address and wipes the mailbox. Why →
Questions
About using the mailbox day to day
Can I use Apple Mail, Outlook or Thunderbird?
Yes — standard IMAP and SMTP over TLS, on desktop and mobile, with no bridge app to install. One caveat worth knowing: mail decrypted into a desktop client is then stored by that client under its own rules. The zero-knowledge guarantee covers what we hold, not what your laptop caches.
How exactly do aliases work?
Two kinds. Tagged aliases like [email protected] exist the moment you use them. Opaque aliases are random strings that reveal nothing about your real address. Both deliver to your one mailbox, both can be disabled individually, and you can send as either.
Is there a limit on attachment size?
Message size follows normal SMTP conventions, which in practice means most receiving servers reject anything much over 25 MB regardless of what we allow. For larger files, use the encrypted file storage and send a link — it is faster, it survives the recipient's size limits, and the file stays encrypted at rest.
Can I import my existing mail?
Yes, over IMAP from any provider that offers it. Bear in mind everything imported is encrypted on arrival, which takes time proportional to the volume — a decade of Gmail is not a thirty-second operation. Ask support before starting a large migration and we will make sure it goes cleanly.
What happens to mail sent to a disabled alias?
It is rejected at the gateway with a permanent SMTP failure, so the sender is told rather than left believing it arrived. That is deliberate: silently discarding mail is how people miss things that mattered.
Every feature, on both plans.
The only decision left is whether you want a renewal date.
$99 / year or $599 for life · Crypto only · All sales final · No phone number, no KYC