Why you can't send email from JavaScript in the browser (and what to do instead)

---

title: Why you can't send email from JavaScript in the browser (and what to do instead) description: Trying to send email straight from JavaScript with SMTP.js and hitting "Mailbox name not allowed" or nothing at all? Here's why browser SMTP can't work — and the safe one-line fix. date: 2026-06-20 author: wwwform tags: [javascript, email, smtp] hero: broken-form tldr: Sending SMTP email directly from browser JavaScript means exposing your email password in page code, so it's blocked, abused, and unreliable — that's the source of errors like "Mailbox name not allowed." The safe pattern is to POST your form to a backend that sends the mail. wwwform is that backend, added with one line. faq:

• q: Why does SMTP.js give "Mailbox name not allowed" or just fail? a: Browser SMTP libraries route your credentials through a third party and your mail provider rejects or rate-limits the attempt, which surfaces as cryptic SMTP errors. Even when it works, your password is sitting in page source for anyone to read. A server-side handler avoids all of this.
• q: Can I ever safely send email straight from client-side JavaScript? a: No. Email credentials and API keys must stay on a server, never in code the browser downloads. The correct pattern is always to send the form data to a backend that holds the secrets and sends the mail. wwwform provides that backend.
• q: What do I use instead? a: Send the form to a hosted form handler. With wwwform you paste one snippet, and every submission is emailed to you and saved to your dashboard — no SMTP credentials, no server code.

---

You wanted a form to email you, found a library like SMTP.js that promised to send mail straight from JavaScript, dropped in your SMTP host and password — and got a cryptic error like "Mailbox name not allowed," a silent failure, or mail that only sometimes arrives. Then you searched the error and found a wall of conflicting advice.

Here's the part the libraries don't lead with: you can't safely send email from the browser at all. The approach is broken by design.

Why browser SMTP can't work

To send email you need SMTP credentials or an email API key. The moment that secret is in JavaScript the browser downloads, anyone can open the page source and read it. That's not a small risk — leaked SMTP credentials get used to send spam from your account within hours.

To paper over that, browser SMTP libraries route your login through their server. So now your credentials pass through an unknown third party, your mail provider sees logins from unfamiliar infrastructure and blocks or rate-limits them, and you get exactly the kind of "Mailbox name not allowed" rejection that sent you searching. The error isn't a typo you can fix — it's the architecture pushing back.

The pattern that actually works

Real form-to-email always follows the same shape:

1. The browser POSTs the form data to a server.
2. The server — which holds the secret credentials safely — sends the email.

Your secrets stay on the server, your mail provider sees a trusted sender, and delivery is reliable. You don't have to build that server yourself.

The one-line fix

Build your form once in wwwform and paste a single snippet into your page:

<div id="wwwform-k_yourkey"></div>
<script src="https://cdn.wwwform.com/f/embed.js" data-wwwform="k_yourkey" async></script>

The form renders where you drop the snippet, the submission is POSTed to wwwform's backend, and you get an email the moment someone fills it in — with no SMTP host, no password in your code, and nothing to leak.

If you'd rather keep your own JavaScript

Prefer to handle the form's markup yourself? You can POST directly to a wwwform endpoint from your own fetch() call and let wwwform do the sending. Either way the credentials live on the server where they belong — never in the browser.

One line, and your form sends real email the safe way.