VaelMask: Private Email Aliases

Create private receive-only email aliases on any web form and automatically fill verification codes with VaelMail.

VaelMask: Private Email Aliases & Verification Autofill Powered by VaelMail Protect your personal email from spam, tracking pixels, and database breaches. VaelMask creates private, receive-only email aliases directly inside web forms, listens for incoming confirmation messages in real time, and fills verification codes with one click. ### What is VaelMask? Every time you sign up for an online account, start a free trial, or download a resource, you hand over your personal email address. That address quickly gets shared with marketing networks, data aggregators, and third-party lists that eventually get leaked in data breaches. VaelMask connects your browser to your sovereign VaelMail account. When an email field appears on any webpage, VaelMask lets you create a unique, private alias (like 8f92a10b4c8d@vael.pw) and inserts it into the input with one click. When the service sends you a confirmation PIN or sign-in link, VaelMask detects the incoming message in real time and displays the code directly on your current tab, ready to autofill. Your primary email address is never shared with the website. If any service starts sending spam, you can pause or delete that alias immediately without touching your real inbox. ### Key Capabilities 1. One-Click In-Field Alias Generation VaelMask detects email inputs on registration pages, checkouts, and subscription forms. A small Vael trigger appears inside the input field. Click the icon or press Enter to generate a new receive-only alias, save the site association on your machine, and populate the field instantly. 2. Real-Time Verification Code Autofill No more switching tabs, opening webmail, or waiting on inbox refresh buttons. Powered by VaelMail's real-time Dovecot IMAP and Redis delivery pipeline, VaelMask receives incoming confirmation messages in under a second. A floating assistant card displays the 4-to-8 digit verification code directly on your page. 3. Instant OTP Form Injection Click "Fill code" to automatically populate single-field inputs or segmented multi-box PIN inputs. VaelMask dispatches native input events so client-side form validators register the code without manual pasting. 4. Direct Magic Link Detection If a service sends an email sign-in link instead of a numeric code, VaelMask extracts the destination URL, strips tracking redirects, confirms the target domain, and provides a direct button to complete your login. 5. Domain-Aware Toolbar Popup Click the VaelMask extension icon in your toolbar to see the alias assigned to the website you are currently visiting. Copy addresses to your clipboard, search through your alias vault, pause incoming mail from noisy senders, or delete addresses you no longer need. 6. Full-Tab Desktop Workstation Open VaelMask as a full tab for a complete privacy console. Browse your recent verification codes audit log with timestamps, manage domain exclusion lists, and view your account capacity in a clean retro-modern interface. 7. Zero Telemetry Architecture Your browsing habits are strictly private. The associations between websites and your generated aliases stay saved exclusively on your local device. VaelMask includes zero analytics trackers, zero behavioral telemetry, and zero advertisements. ### How It Works Step 1: Install and Connect Open the extension popup and click "Connect VaelMail". A 6-character comparison code appears in your popup. Confirm that the code matches the prompt on vaelmail.com/vaelmask and approve access. The extension never handles or stores your account password. Step 2: Sign Up on Any Website Open any registration or checkout page. When you focus on an email field, click the Vael icon and select "Generate new alias". Step 3: Autofill Your Verification Code Submit the form. When the website sends its verification message, the VaelMask Assistant card appears with your code. Click "Fill code" to finish registration. Step 4: Manage Your Privacy If an alias starts receiving unwanted mail, open the toolbar popup, find the alias for that website, and click "Pause" to temporarily reject mail or "Del" to delete it permanently. ### Why VaelMask is Powered by VaelMail Public temporary email services have severe limitations: their domains are routinely blacklisted by websites, their inboxes are publicly readable by strangers, and they cannot receive follow-up password resets. VaelMask runs on top of VaelMail's sovereign email infrastructure: - Clean sender reputation and high deliverability on standard domain pools. - High-speed notification pipeline using Dovecot IMAP change notifications and Redis event pub/sub. - Strict least-privilege security: the extension can only query messages delivered specifically to the authorized alias, keeping your primary mailbox isolated. ### Security and Privacy Details - Cryptographic Dual-Key Pairing: The extension pairs with your VaelMail account using dual 256-bit cryptographic secrets stored as SHA-256 hashes. - Atomic Token Rotation: Refresh tokens rotate automatically with each use. Presenting an already-consumed token triggers instant revocation of the entire token family. - Local Storage Isolation: The mappings between websites and your aliases are stored exclusively in chrome.storage.local on your device and are never sent to external servers. - Recipient-Filtered Mail Access: When retrieving verification codes, the backend API filters mail strictly by recipient alias (deliveredTo check). The extension cannot read messages delivered to your personal address. - Instant Revocation: You can inspect and revoke authorized browser extensions at any time under Account Security in your VaelMail dashboard. ### Permissions Guide Chrome Web Store requires extensions to explain why each permission is requested. VaelMask uses only what is required to generate aliases and autofill codes: - storage: Required to store your paired session tokens, active aliases, and local domain mappings securely on your computer. - activeTab: Required to check the hostname of your active browser tab so the popup can show you the alias assigned to that website. - https://vaelmail.com/*: Required to execute the cryptographic pairing flow, create aliases, and fetch verification codes for your active aliases. - http://*/* and https://*/*: Required by the content script to find email input fields, display the in-field trigger button, and fill verification codes into web forms. ### Frequently Asked Questions Q: Do I need a VaelMail account to use VaelMask? A: Yes. VaelMask operates as the browser companion to VaelMail. If you do not have an account yet, you can create one at vaelmail.com. Q: Can I receive codes from any service? A: Yes. VaelMask supports standard 4-to-8 digit numeric codes, spaced codes (such as 123 456), hyphenated codes (such as 482-910), and alphanumeric PINs. It also detects direct magic login links. Q: Can I send outbound emails from these aliases? A: VaelMask aliases are receive-only privacy shields built for registrations, verifications, and notification delivery. If you need to send outbound messages, log in to your VaelMail account directly. Q: Can I pause an alias instead of deleting it? A: Yes. Pausing an alias temporarily rejects incoming mail while keeping your account association intact. You can unpause it later if you need to request a password reset or sign-in link. Q: What happens if a site sends a link instead of a numeric code? A: VaelMask scans incoming messages for verification links, strips tracking redirects, confirms the target domain, and gives you a direct link in the assistant window. Q: Does VaelMask track my browsing history? A: No. VaelMask does not log or monitor your browsing activity. The content script runs locally to detect email and OTP input fields. No URLs or browsing logs are sent to external servers. Q: What are the alias limits? A: Free VaelMail accounts can have up to 50 active receive-only aliases at any time. Paid accounts have unlimited aliases. ### Open Source and Auditability VaelMask is built on standard WebExtension Manifest V3 APIs with zero obfuscated third-party tracking binaries. Source code and release packages are published openly for independent security review. Support: https://vaelmail.com/support Privacy Policy: https://vaelmail.com/privacy/vaelmask Documentation: https://vaelmail.com/docs/vaelmask