All help articles

Two-step sign-in and app passwords

Two-step sign-in means a stolen password is not enough to open your mail. Signing in to webmail then needs your password and a code from an authenticator app on your phone. Mail apps can't ask for a code, so they use app passwords instead: a separate password for each app.

If you sign in with your Zappocity account (single sign-on), set two-step sign-in up there instead: an authenticator app, a hardware security key (YubiKey) or a passkey (1Password, iCloud Keychain, Google Password Manager, Windows Hello). It then protects webmail and every other Zappocity product, and webmail's settings link to it. See One sign-in for everything.

Turn it on

You need an authenticator app, such as Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden, Aegis or Raivo.

1. In webmail, open Settings (the gear at the top right).
2. Under Two-step sign-in, enter your current password and choose Set up.
3. Scan the QR code with the app. If you can't scan it, type the key shown under it into the app instead.
4. Enter the 6-digit code the app shows, then choose Turn on.
5. Save the ten recovery codes somewhere safe, such as a password manager or printed on paper. They are shown only once.

When it turns on:

• Every other browser is signed out. This one stays signed in.
• Mail apps stop accepting your account password. Make an app password for each one, as described below.
• If you have a recovery address, it gets a notice.

Signing in

Enter your address and password as usual. Webmail then asks for a code. Enter the 6-digit code your app shows now. Each code works once; if one is refused, wait for the next.

If the code is always refused, check that your phone's clock is set automatically. Codes depend on the time, and a clock that is more than about 30 seconds off produces wrong codes.

Wrong codes count as failed sign-ins: after 10 failures in 15 minutes, signing in is paused for that address.

Lost your phone?

Enter one of your recovery codes where webmail asks for the code. Each recovery code works once. Then, in Settings, turn two-step sign-in off and on again with your new phone, or choose New recovery codes if you are down to a few. Settings shows how many are left.

If you have neither your phone nor a recovery code, ask your administrator to turn two-step sign-in off for you. A password reset does not turn it off: after a reset you still need a code.

App passwords

An app password lets one mail app (Outlook, Apple Mail, Thunderbird, a phone's mail app) sign in with IMAP, SMTP or ManageSieve. It is 16 letters long and shown only once. Type it where the app asks for your password, with or without the spaces.

To make one: in Settings, under App passwords, name the app (for example "Work laptop Thunderbird"), enter your current password and choose Make app password. If you sign in with Zappocity, there is no password to enter: unless you signed in in the last 10 minutes, Confirm on Zappocity first, then make it. While single sign-on is on, every mail app needs one.

• App passwords never sign in to webmail.
• Each one can be removed on its own. Apps using a removed one are signed out within about a minute, without affecting the others.
• Settings shows when each was last used, so you can spot ones you no longer need.
• You can have up to 25.
• Changing or resetting your account password removes all of them.

App passwords also work without two-step sign-in, alongside your account password.

Turn it off

In Settings, enter your current password and choose Turn off. Your password alone signs in again, in webmail and in mail apps. Your recovery codes are deleted; app passwords stay until you remove them.

For administrators

The user list in the admin panel has a Two-step column. For a user who lost both their phone and their recovery codes, choose Reset two-step. Before you do, confirm who is asking, for example by calling them on a number you already have: anyone who knows the password can sign in afterwards. Through the API:

DELETE /v1/tenants/{tenantId}/accounts/{accountId}/two-factor

This deletes the secret and the recovery codes. It leaves the account's app passwords and open sessions alone.

How it works

• Codes are standard TOTP (RFC 6238): SHA-1, 6 digits, a new code every 30 seconds. One code before or after the current one is also accepted, to allow for clock drift. A code can't be used twice, even by two sign-ins at the same moment.
• The secret is encrypted with the server key before it is stored. Recovery codes and app passwords are stored only as hashes.
• Turning it on needs a code from the new secret, which proves your app has it. Turning it on or off, and making recovery codes or app passwords, all need your current password, so someone with only your open browser cannot change them.
• Webmail sign-in uses the webmail API: the first request returns twoFactorRequired: true, and the second sends the code as code.

Two-step sign-in for platform administrators (the SaaS admin panel) is planned separately.