Chrome Opens Trial for the Email Verification API: Letting Sites Verify Without Sending Emails

Google has launched a Chrome trial for the Email Verification API, a Web Incubator Community Group (WICG) proposal that allows websites to confirm if a user owns the email address they provided, without sending any messages. The Chrome 150 update introduced the trial on desktop, with Gmail as the first participating provider. The API replaces the usual one-time code or magic link verification process, where users receive an email, copy a code, and return to complete the sign-up.

Instead, the browser handles the verification process through a three-party model: the browser mediates between the site (verifier) and the mailbox provider (issuer). If the user is signed in to their provider, the browser fetches a signed token and inserts it into the form, allowing the server to validate it upon submission. Developers can easily implement the API by adding an autocomplete hint to the email field and a hidden input with a session-bound nonce on the server side, where the token signature is checked against the provider's keys.

The API aims to improve user experience by removing a potential context switch and addressing issues like emails being blocked or filtered to spam. However, some developers and privacy advocates question the claim of enhanced user privacy, as the issuer remains unaware of which web application is requesting verification. The Email Verification API is currently an experimental proposal, and developers should monitor breaking changes as it progresses.