How I Built a Free Anonymous Email Service — No Phone, No Password, No Logs

The Problem I Wanted to Solve

Every time you sign up for a new email service, you're asked for:

• A phone number
• An existing email address
• Your real name
• A government ID (in some countries)

I asked myself: what if email could work like cash? Anonymous by default. No identity required. No trail left behind.

That's how QRYPTY Mail was born — a fully functional, free anonymous email service where your only credential is a 32-character access code.

How It Works (The User's Perspective)

1. Go to qrypty.com/register
2. Pick a username → your address is username@qrypty.com
3. Receive a 32-character access code (your only key)
4. Save it. Done. You have a working email inbox.

No phone. No password. No "verify your identity." No CAPTCHA asking you to identify traffic lights for 5 minutes.

Your access code: Kx7mP2vL9nQ4wR8jF3sA6dG1hY5tB0eN

That's it. That string IS your login. Lose it → lose access forever. We don't store it, can't recover it, and have zero idea who you are.

Technical Architecture

Here's what's under the hood:

┌─────────────┐     ┌──────────────┐     ┌────────────┐
│   Nginx     │────▶│   FastAPI    │────▶│ PostgreSQL │
│  (SSL/TLS)  │     │   Backend    │     │   (Data)   │
└─────────────┘     └──────┬───────┘     └────────────┘
                           │
                    ┌──────┴───────┐
                    │  aiosmtpd    │
                    │ SMTP Server  │
                    │  (Port 25)   │
                    └──────────────┘

The Authentication Model

Traditional email services:

username + password → server verifies → session

QRYPTY Mail:

32-char code → bcrypt verify → JWT (7 days) → access

There's no "forgot password" flow. There's no 2FA because the code IS both factors — something you have (the code) and something you know (where you stored it).

Why 32 Characters?

With 62 possible characters (a-z, A-Z, 0-9) and 32 positions, brute-forcing is mathematically impossible.

Privacy by Architecture

Most services say "we respect your privacy" but still collect everything. QRYPTY Mail is architecturally incapable of violating your privacy:

No Logs — How?

# Our nginx config:
access_log off;

# Our application:
# No IP logging
# No request logging
# No analytics tracking
# No third-party scripts

We literally cannot tell law enforcement who owns an account because we don't know. The access code is bcrypt-hashed — it's a one-way function.

Anti-Spam Without Surveillance

A common argument: "Anonymous email = spam paradise." Here's how we handle it without compromising privacy:

Inbound Spam Filter

def calculate_spam_score(from_addr, subject, body_text, body_html):
    score = 0.0

    # Check spam keywords
    spam_words = ["viagra", "casino", "lottery", "winner", ...]
    for word in spam_words:
        if word in subject.lower(): score += 3.0
        if word in body.lower(): score += 1.5

    # Suspicious TLDs
    if from_addr.endswith(('.xyz', '.top', '.buzz')): score += 2.0

    # ALL CAPS subjects
    if upper_ratio > 0.7: score += 2.0

    return score  # > 5.0 = spam

Outbound Rate Limiting

New accounts get strict limits. Established accounts get generous ones. Spammers give up because they can't mass-send from fresh accounts.

Full Email Compatibility

QRYPTY Mail isn't a toy — it's a real email service with full RFC compliance:

13 Languages, Zero Barriers

The interface supports 13 languages out of the box:

Every UI element, error message, and captcha is fully translated.

The Captcha System (Anti-AI)

Instead of Google reCAPTCHA (which tracks you), I built a custom visual captcha with 10 challenge types:

1. Color-based — "Type only the BLUE characters"
2. Strikethrough — "Type characters WITHOUT a line"
3. Size recognition — "Type the BIGGEST character"
4. Spatial position — "Type only the TOP row"
5. Shape counting — "How many circles?"
6. Rotation detection — "Type only UPRIGHT characters"

These exploit the gap between human visual reasoning and AI/OCR capabilities. Humans solve them in 2-3 seconds. Bots can't distinguish color or spatial position from extracted text.

Performance

Comparison with Other Services

Real-World Use Cases

Try It Now

👉 qrypty.com — Create your free anonymous email in 10 seconds.

No sign-up forms. No verification emails. No waiting.

Just pick a username, save your code, and you have a fully functional email inbox that nobody can trace back to you.

FAQ

Built with FastAPI, React, PostgreSQL, and a healthy distrust of surveillance capitalism.

🔗 qrypty.com | Create your anonymous email now