Eleven surfaces, no mockups.
Every image below is a capture of a running instance at 1440×900, not a rendering of one. The domain is mail.hexajo.com because that is what the maintainer’s instance runs on — yours will read whatever you point at it. Click any screenshot to open it full size; arrow keys page through the set.
Everyday use
What a developer, QA engineer or support rep touches in the flow of work. Create, receive, read, move on.
Generate an inbox
The address is minted before the page finishes settling. Pick a TTL from the presets or type your own, hit Generate, and the grid below fills with every inbox you own — each with its remaining life, unread count, and a renew button that buys another 24 hours. Only the creator can read an inbox, and that is enforced in the service layer rather than in the UI.
Live inbox
Inbound mail is parsed by the Go SMTP server, written to Postgres, then published on a Redis channel that the API bridges into the WebSocket hub. The list you are looking at updates in the same second the message is accepted. The TTL counter next to the address is tabular-figured so digits do not shift as it ticks down.
Email reader
HTML bodies are sanitised with bluemonday before they are ever persisted, so what the reader renders is what the database holds. Switch to plain text or raw headers when you are debugging a sender rather than reading mail. Attachments are served from MinIO, S3, or the local-filesystem fallback via presigned URLs, and sixteen executable extensions are refused outright at ingest.
Organization dashboard
The operational summary for an organization: total mail received, inboxes currently alive, domains configured, and how much object storage the attachments are consuming. The email-volume series is backed by rollup tables maintained by the analytics worker, not by counting rows at request time.
Analytics
Five rollup tables — hourly, daily, per team, per domain, per sender domain — are maintained by a background worker and cached, so the charts answer instantly at any retention depth. Scope the view to the whole organization or to a single team.
Governance
What an administrator is accountable for. Domains, teams, the audit trail, and the settings that cascade down from them.
Domains and DNS
Add a domain, get a verification token, publish an MX record pointing at your SMTP host and a TXT record carrying the token. The API checks both, re-checks hourly via the dns_recheck worker, and keeps a verification history you can look back through. A failed lookup never downgrades an already-verified record, so a resolver blip cannot flip a domain red.
Teams
Teams are the unit that domains, webhooks and API keys hang off. Assign a domain to a team and its members can mint inboxes on it; archive a team and the impact is shown before you commit. Bulk add and remove members without leaving the page.
Audit log
Who, when, what, and against which resource. Filter by actor, action, resource type or date range, and export the result as CSV for a compliance review. System admins get the same surface across every organization on the platform.
Settings
Mailer, storage, SSO and platform settings are stored in the database and hot-reloaded across every process via Redis pub/sub — changing them takes effect without a restart. SSO providers are configured at runtime, with email-domain mappings that route users to the right provider at sign-in. Credentials are encrypted at rest with AES-256-GCM.
The way in
The surfaces a visitor to your instance meets before they have an account.
Your instance, signed out
Every instance ships this page. Registration can be open, invite-only, or closed entirely in favour of SSO, and the page adapts to whichever you chose. An optional public demo inbox at /try is available and off by default.
Sign in
Password auth with refresh tokens, optional httpOnly refresh cookies, account lockout and a configurable password policy. When OIDC providers are configured, the same form resolves the address to the right provider and hands off. Sessions are listable and revocable, with a per-user session cap.
The interface is light-only by design and the reasoning is written down: a single indigo accent used on no more than a tenth of any screen, one type family carrying every role, and a reserved amber that appears in exactly two places. DESIGN.md is the whole system, published alongside the code.