How reader links work

A reader link looks like https://your-domain/r/<secret>. Opening it shows recent Inbox and Junk messages from the mailboxes you assigned to that link — without an InboxReader or Outlook sign-in.

Expiry, access codes and one-person links

When creating a link, or from Actions → Access controls, set an expiry, maximum reader sessions, a required access code and its allowed uses, or one allowed email address. A one-use code unlocks one browser session; refreshing messages does not consume it again. Sessions last up to 8 hours and end sooner when the link expires.

An email-restricted reader requires sign-in with that verified email. New recipients can create a viewer account, confirm their email and open shared readers from their viewer home. Viewer accounts cannot connect mailboxes, create reader links or use administration.

Saving access controls or rotating the URL revokes earlier reader sessions and restarts use counters. A blank replacement-code field keeps an existing code. Send the code separately from the private URL.

Multiple links

You can create several links with different mailbox permissions, for example “Personal” with two mailboxes and “Support” with one shared mailbox. Each link can be renamed, disabled, rotated or deleted independently.

What the reader shows

• Inbox and Junk Email, newest first, with “Load more” for older messages.
• Filters per mailbox and search across sender, subject and message body.
• Detected verification codes with a copy button.
• The full message when you open it. Email HTML is sanitized and remote images are blocked until you choose to load them.

How the secret is protected

Each link uses 256 bits of randomness. InboxReader finds links by a SHA-256 hash of the secret and keeps an encrypted copy so you can copy the URL again from your dashboard. Reader pages are never indexed and tell browsers not to send the URL to other sites.