New device, new code. Your family gets it without asking you.
Netflix, Disney+ and HBO Max email a verification code to the account holder every time someone signs in on a new TV or phone. Shared Codes collects those emails into one read-only link, so your family reads the code themselves.
The code lands in your inbox. The person who needs it is somewhere else.
Saturday night, your parents' new TV
Netflix asks for a 4-digit code on the TV and emails it to you. It expires in 15 minutes. You dig through your inbox, screenshot it, post it in the family chat, and hope they got it in time.
"Yes, this was me", from another city
Disney+ and HBO Max send a confirmation button instead of a code. The button is in your mailbox; the person signing in is 300 km away. You end up clicking it blind.
The shared ChatGPT or Claude account
ChatGPT and Claude sign you in with a 6-digit code sent to the registered mailbox instead of a password. The account is in your name, so every login by a teammate or family member lands on you.
Handing out your mailbox password? No.
Your main inbox holds the reset links for every account you own. Shared Codes only receives the verification emails you choose to forward; password resets, receipts and security alerts are kept out by default.
Use it within each service's sharing rules: the people in your household, or the seats on your team plan.
Set it up once. Never forward a code again.
- Netflix sendsVerification code email
- Your mailboxOne forwarding rule
- Forwards tocode@yourdomain
- Shared CodesFinds the code, hides the rest
- Your familyOpens the link, reads the code
Forward only the verification emails
In Gmail or Outlook, add one rule: mail from Netflix, Disney+ or HBO Max goes to your Shared Codes address. Everything else stays where it is.
Shared Codes picks out the code
Each email is read the moment it arrives. The 4 to 8 digit code is pulled to the top with a copy button; confirmation buttons still work. Password resets and receipts never show up.
Send one link to the family
Create a read-only link that shows only recent mail, say the last hour or the last day. Pin it in the family chat. Revoke it whenever you like.
No mail server to run
One Worker with D1 and R2 replaces the VPS, SMTP stack and IMAP polling that older tools need.
$0/month, nothing to maintain
No VPS, no Docker SMTP stack, no port 25 to unblock. The free tiers of Email Routing, Workers, D1 and R2 cover a family or a small team. All you need is a domain on Cloudflare.
Instant, no IMAP polling
An Email Worker is invoked for each forwarded message as it arrives, so the code is on the page before anyone refreshes.
No email password, no OAuth
Shared Codes only receives what your forwarding rule sends. It never connects to Gmail or Outlook and never asks for read access to your inbox.
Built for one job: getting the code to the right person
Codes up front
4 to 8 digit codes are detected on arrival and shown as a large copy button. Full HTML is kept, so confirmation links still work.
Rolling time windows
A link shows only recent mail. Old codes scroll out of view on their own; nothing is shared forever.
Sensitive mail stays hidden
Password resets, receipts and account-security alerts never appear on a share page unless you opt in for that link.
Read-only by design
Viewers cannot reply, forward or delete. HTML is sanitized and sandboxed, remote images stay off by default, attachments download only.
Works with any mailbox
Gmail, Outlook, iCloud or your own domain: anything that can forward mail can feed Shared Codes.
Yours to run
One Cloudflare Worker with D1 and R2, deployed from GitHub in minutes. MIT licensed.
Households, small teams and self-hosters
Streaming at home
Netflix on the living-room TV, Disney+ on the kids' tablet, HBO Max at your parents' place: everyone reads the code from the same link instead of messaging you. Use within each service's household rules.
Small teams
The shared Canva, ChatGPT or social-media account that only signs in with an email code: hand out a link instead of the mailbox password, and take it back when someone leaves.
A web UI for Email Routing
Email Routing can only forward. Point one address at Shared Codes and you get a lightweight, read-only inbox viewer for it, with no mail server behind it.
A verification code is a key. We treat it like one.
Share links only with people you trust, keep sensitive filtering on, and revoke access when it is no longer needed.
Every link ends in a random key, with optional expiry and instant revocation.
no-store, noindex and a strict Content-Security-Policy on every page. Share pages load no third-party scripts or fonts.
Email HTML is sanitized in the browser and rendered in a sandboxed iframe with its own policy.
Mail and attachments are deleted automatically after the retention period, 30 days by default.
Questions
Does this bypass Netflix's household check?
No. It only shows emails you choose to forward. Streaming services set their own sharing terms; use Shared Codes within them.
Can viewers see my other mail?
Only mail delivered to the shared address appears, and your own filter decides what is forwarded there.
What does it cost?
Nothing beyond a domain on Cloudflare. The free tiers of Email Routing, Workers, D1 and R2 cover typical use.
Is my data stored by you?
No. You deploy Shared Codes in your own Cloudflare account. We never see your mail.
Do I need a mail server, a VPS or port 25?
No. Cloudflare Email Routing receives the mail and an Email Worker processes it. There is no SMTP or IMAP server anywhere in the setup.
Can I use it as a web inbox for Cloudflare Email Routing?
Yes. Any address you route to the Worker becomes a read-only web page. It is a viewer, not a full mailbox: no sending, no folders, 30-day retention by default.
How do I forward only verification emails?
Create a filter that matches senders or subjects, for example from:netflix.com, and set it to forward to your Shared Codes address. Outlook and iCloud offer the same rule-based forwarding.
Prefer not to run it yourself?
A hosted Shared Codes gives you a dedicated receiving address and an admin dashboard. All you do is create share links.
Send a request and we will reply within 24 hours.