First, match the email to what you just did on the portal
Imagine arriving at an airport in 2026 and joining its guest Wi-Fi. The portal asks for your email, then says, “Check your inbox for a confirmation email.” A message with the airport’s name soon appears in your temporary inbox. Before clicking the biggest button, recall who asked you to verify, which address you entered, and what the page said would happen next.
A matching timestamp and a subject like “Welcome to Wi-Fi” can help connect the email to your sign-in attempt, but they don’t prove it’s genuine. Check that the recipient address matches the one you entered, then compare the portal’s information about the network operator. If you didn’t start a sign-in but received a confirmation email, there’s no need to click it just to find out why.
Hotels may use third-party network providers, so an email domain may differ from the hotel’s official website. But outsourcing alone isn’t a reason to trust an unfamiliar domain. Ask the front desk or airport information desk for the provider’s name and domain. Don’t verify a suspicious email by calling a number it provides.
The display name, sender address, and link destination are three different things
“Airport Guest Wi-Fi” in your inbox is a display name. The address in the email headers is the sender address. The URL behind the button is the link destination. These can all differ, and a familiar name may just be text the sender chose to display.
| What you see | What you can check | What it doesn’t prove |
|---|---|---|
| Sender name | Whether it fits the context of your sign-in | That the email came from an official organization |
| Sender address | Whether the domain matches a provider you’ve independently verified | That every link in the email is trustworthy |
| Button or link text | What the link claims it will do | That the text matches the actual destination |
| Actual URL destination | Whether the hostname, protocol, and parameters look expected | That the final page won’t redirect or ask for more information |
An email may mention the official website while linking somewhere else. Expanding the message details can help you check the sender address, but it doesn’t fully authenticate the email’s origin. If there’s no reliable authentication result, don’t treat a plausible-looking address as proof.
Break down an example: check the hostname before reading the whole URL
The reserved example domain below is for explaining URL structure only. It is not a real sign-in page. Real email parameters may grant access, so don’t use this example to construct a URL.
https://login.example.net/guest/confirm?token=REDACTED&lang=zh
https://is the protocol. It means this connection uses HTTPS.login.example.netis the hostname—the first part to check./guest/confirmis the path, which identifies a page chosen by the site.?starts the query parameters, which may include a verification token, language, or redirect destination.
A path named “confirm” doesn’t mean the page is genuine, and an airport name in the parameters doesn’t prove who owns the site. A site can set all of this text. If the URL includes a port,@, a long encoded string, or an unfamiliar structure, stop. Don’t let familiar words lead you to assume what the URL means.
Pay close attention to text before @
In https://airport.example@other.example.net/ , the actual hostname is other.example.net, not the “airport.example” text before it. If you see a URL written this way, there’s no need to click it just to check.
Check domain boundaries, not familiar names
familiar-name.example.net has a familiar-looking name on the left that is just a subdomain of example.net . A hotel name, airport name, or the word “secure” doesn’t mean the site is controlled by that organization.
Compare these two examples:login.example.net and example.net.other.example. The second URL contains the full text “example.net,” but it isn’t within the first domain’s scope. The path /example.net/ doesn’t change which host you’re visiting, either.
Look for the boundaries of the full hostname, not just a brand name. And don’t blindly take the last two parts: public suffixes such as co.uk change where the registrable domain begins. The most practical check is to compare the complete domain, character for character, with one confirmed by staff on site or an independent official source.
Also look out for an extra hyphen, a changed letter, lookalike characters, or an internationalized domain name beginning with xn-- . These aren’t always malicious, but visual similarity isn’t enough to confirm who owns a site. If your phone cuts off part of the URL, don’t guess what’s missing.
HTTPS, short links, and redirects can’t prove everything
HTTPS protects data in transit between you and the current domain. It doesn’t verify the operator’s identity, purpose, or page content. Unfamiliar sites can have valid certificates too. The padlock can’t tell you whether an airport approved the sign-in service.
Short links usually hide their final destination. Regular links can also pass through tracking services or multiple redirects. A third-party redirect isn’t automatically a problem, but a plausible first stop doesn’t prove that every later stop is safe.
Not sure? Verify through another channel
Don’t submit a complete confirmation URL containing a token to a public link expander or online scanner. A third party may store, fetch, or use it. Check the original portal’s instructions or ask staff to confirm the domain instead. Don’t open an unknown link just to see where it goes.
If you’ve already opened the link and the address bar shows an unverified domain, or the page asks for information unrelated to Wi-Fi access, stop and close it. A successful redirect, a venue logo, or a countdown timer doesn’t replace verification.
A verification code or confirmation link only completes the step requested by the portal
Some hotel Wi-Fi sign-in flows ask you to enter a six-digit code on the portal; others ask you to open a confirmation link. Some emails offer both. Follow the process shown on the original portal, and don’t click every button in the email one after another.
- Portal asks for a code: return to the original portal to enter it. Don’t send the code to a chat account or someone claiming to be support.
- Portal asks you to confirm with a link: check the actual destination before deciding whether to continue.
- Either method is accepted: complete one, then check the result on the original portal. Don’t verify again just because another button is still there.
- A subscription option appears: distinguish required Wi-Fi terms from optional marketing consent. Don’t mistake “get offers” for email confirmation.
A verification code can authorize an action, so it isn’t automatically safer than a link. Requesting a new code may invalidate the old one; follow the portal’s instructions and use the code for that specific attempt. Don’t mix up steps from different emails or browser tabs.
If Wi-Fi sign-in turns into a request for payment or an account password, stop
If a free guest Wi-Fi email check suddenly asks for card details, your email password, a payment verification code, or asks you to install a certificate, configuration profile, or remote-access tool, pause. Don’t treat an unusual request as “one more step” to get online, even if you’re in a hurry to board.
Some networks do offer paid plans or may legally require identity information, but confirm this independently through a trusted portal and on-site information. Don’t assume a charge or identity check is legitimate just because an email says so, and never enter the password for your regular email account on a Wi-Fi sign-in page.
What if you’ve already entered sensitive information?
Stop submitting information. If you shared a password, change it through an official channel you already trust and review your active sessions. If you shared card details or a payment verification code, contact your bank or payment provider. Then report the network name, time, and suspicious step to on-site staff. Don’t use a “recovery” link from the email.
Long-pressing on a phone or hovering on desktop only gives you limited clues
Hovering over a link in a desktop browser often shows its destination in the status bar. But a long URL may be truncated, and an email button may hide further redirects. If you can’t see the full hostname, don’t treat the visible part as a complete check.
On a phone, long-pressing may show a link, generate an online preview, or even open an app. Behavior varies by operating system and email app, so don’t assume a long-press can never visit the link. If the interface offers a way to copy the destination without opening it, paste it into a local offline text editor to inspect it. Avoid pasting it into an address bar that might open it automatically.
If you can’t reliably check the destination, don’t continue. Go back to the Public Wi-Fi Email Verification Guide to check the steps, or ask on-site staff for another way to sign in. That’s safer than trying an unknown link.
Keep the address and full token to yourself
Some confirmation links can complete verification using only the token in the URL. This isn’t an ordinary web address: don’t share it in group chats, public support tickets, or online translation tools. Your email address may also be associated with records of this Wi-Fi session.
When contacting support@tmpsky.com about an inbox display issue, include the time, device, browser, and what went wrong. Keep necessary domain details in screenshots, but hide private parts of the address, query parameter values, verification codes, and QR codes. Redact tokens in the path, too.
Don’t crop out only the email while leaving the full confirmation link visible in the browser’s address bar. Tmpsky temporary inbox tokens, long-term forwarding login tokens, and portal confirmation tokens are different credentials, but none should be shared. To report a suspicious destination, share a redacted domain and a description of the issue—not a working, complete link.
A temporary inbox is not a link safety service
Before continuing to use your temporary email inbox, remember these three limits. You don’t need to know every detail of how the internet works; just know when to stop guessing.
- Receiving an email doesn’t mean it’s trustworthy. Your inbox displays messages; it doesn’t vouch for senders, links, or attachments.
- Temporary doesn’t mean anonymous. When an address expires, it doesn’t undo information you gave the portal or erase records held by external websites.
- Forwarding doesn’t mean scanning.Long-term forwarding keeps messages coming to you, but it doesn’t make unknown links trustworthy.
A temporary address can work for one-time sign-in. For anything that may need to contact you again, use an email address you control long term. Check the live countdown to see when an address expires. For details, compare10-minute, one-hour, and long-term forwarding options. If you can’t find your inbox after switching networks, see Switching networks and inbox access details.
Check first, then get back to your inbox
Use a temporary inbox for one-time verification. For ongoing contact, sign in to set up long-term forwarding. Neither option checks whether a link is safe.