Tokens and addresses stay in this browser. Requests reach DuckDuckGo Email Protection through a CORS proxy — source.
DuckDuckGo emails a passphrase to your forwarding address.
The permanent token, not the login passphrase. It is checked the first time you generate an address.
DuckDuckGo blocks browser requests, so calls are relayed. The target URL is appended to this prefix.
Session
No account signed in.
Everything is included by default, which is what a full restore needs. Access tokens travel with their accounts — an account without one cannot generate addresses.
Pick how a backup file meets what is already here.
Each action affects this browser only. Your DuckDuckGo account and its aliases stay untouched.