Share verification codes without forwarding them by hand
InboxShare turns one address on your domain into a read-only web page. Set a filter in Gmail or Outlook once, and your family or teammates read the latest login codes themselves.
No app to install. No accounts for viewers. Nothing leaves your mailbox except what your filter forwards.
How it works
Forward the right emails
Add a filter in your mailbox: only mail from Netflix, Disney+ or your team's tools, only subjects with a code. Everything else stays where it is.
InboxShare receives them
Cloudflare Email Routing hands each mail to a Worker that extracts the code and sorts it. Password resets, receipts and account alerts are kept out by default.
Share one link
Create a read-only link with a time window: the last 30 minutes, 24 hours or 7 days. Revoke it whenever you like.
Built for one job: getting the code to the right person
Codes up front
The 4 to 8 digit code is detected on arrival and shown as a big copy button, both in the list and inside the message.
Rolling time windows
A link shows only recent mail. Old codes scroll out of view on their own; nothing is shared forever.
Sensitive mail stays hidden
Password resets, receipts and account-security alerts never appear on a share page unless you opt in for that link.
Read-only by design
Viewers cannot reply, forward or delete. HTML is sanitized and sandboxed, tracking pixels do not load, attachments download only.
Works with any mailbox
Gmail, Outlook, iCloud or your own domain: anything that can forward mail can feed InboxShare.
Yours to run
One Cloudflare Worker with D1 and R2. The free tier covers a family or a small team. MIT licensed.
Who it is for
Streaming at home
Family members signing in on a TV or a new phone read the verification code themselves instead of messaging you. Use within each service's household rules.
Small teams
Shared tool accounts that only support email codes: hand out a link instead of the mailbox password, and take it back when someone leaves.
Security
- Links are 32-character random keys, with optional expiry and instant revocation.
- Every page is served with no-store, noindex and a strict Content-Security-Policy; no third-party scripts or fonts.
- Email HTML is sanitized in the browser and rendered in a sandboxed iframe with its own policy.
- Mail is deleted automatically after the retention period, 30 days by default, attachments included.
Questions
Does this bypass Netflix's household check?
No. It only shows emails you choose to forward. Streaming services set their own sharing terms; use InboxShare within them.
Can viewers see my other mail?
Only mail delivered to the shared address appears, and your own filter decides what is forwarded there.
What does it cost?
Nothing beyond a domain on Cloudflare. The free tiers of Workers, D1 and R2 cover typical use.
Is my data stored by you?
No. You deploy InboxShare in your own Cloudflare account. We never see your mail.