The short version is: Traditionally, Bob needed to “log in” to be able to send a message to Alice’s inbox.

With Sealed Sender, Alice gives Bob a credential that allows him to message her from now on without logging in.

Only Alice can tell that the message she received is from Bob.

There’s some subtlety around bootstrapping these credentials and preventing abuse which means that not every message can be sent as Sealed Sender, but the vast majority are. Read the blog post for the authoritative explanation.

There’s an option in the app settings to make visible which of your messages were sent without identifying your client to the server if you’re curious.