Use the Security settings to change your password and recovery email address, set up passkeys and Two Factor Authentication, manage App Passwords, and review your recent sign-ins. In the WorldClient theme, each of these tasks opens in its own dialog from the Security settings. In the Pro theme, they are all on the Security page. Most of these tasks ask you to enter your Current Password (required) before you can make changes.
Passkeys, Two Factor Authentication, and App Passwords are available only when you sign in to Webmail using https:// in the browser rather than http://.
Signing In
Change Password
To change your password:
1.In the Security settings, click Change Password.
2.Enter your Current Password (required).
3.Enter a New Password, and enter it again in Confirm Password.
4.Click Change Password.
Passwords have some minimum security requirements, such as a minimum length or a mix of upper and lower case letters and numbers. As you type your new password, Webmail shows how strong it is and which requirements it does not yet meet. When you change your password, all of your App Passwords are deleted.
Remember Me
If you chose to be remembered when you signed in on the device or browser you are using, the Security settings say so and display a Do not remember me on this device/browser button. Click it if you no longer want to be remembered there.
A recovery email address lets you get back into your account if you ever forget your password. To set up or change your recovery email address:
1.In the Security settings, click Change Recovery Email.
2.In the Recovery Email box, enter some other email address to which you have access, such as another personal or work email address.
3.Enter the same email address in the Confirm Recovery Email box.
4.Enter your Current Password (required).
5.Click Change Recovery Email.
Once set, if you attempt to sign in to Webmail with an incorrect password a "forgot password?" link will appear. This link takes you to a page that asks you to confirm your password recovery email address. If you enter the correct email address, an email message will be sent with a link to a page where you can change your password.
Sign-In Passkeys
Sign-in passkeys let you sign in to Webmail without entering your password, by using your fingerprint, your face, a security key, or another device. To set up a sign-in passkey:
1.Sign in to Webmail using https:// in the browser rather than http://.
2.In the Security settings, click Set up Sign-In Passkeys (or Manage Sign-In Passkeys, if you already have one).
3.Under Register a New Sign-In Passkey, choose the kind of device you wish to use, or choose Use any available authentication method.
4.Enter your Current Password (required), and click Get Started.
5.Follow the directions that appear for choosing and verifying your device.
6.When finished, the passkey is listed under Registered Sign-In Passkeys. To remove a passkey from the list, click Revoke.
A device that is registered as a sign-in passkey cannot also be registered as a Two Factor Authentication passkey, and vice versa.
The Pro theme uses different names for sign-in passkeys: it calls them Passwordless Sign-In credentials. To add one, click New Sign-In Credential instead of Set up Sign-In Passkeys, and look for your passkeys under Registered Sign-In Credentials instead of Registered Sign-In Passkeys. The steps are otherwise the same.
Two Factor Authentication (2FA)
Two Factor Authentication (i.e. 2-Step Verification) can make your account more secure by requiring you to enter a verification code, authenticate with your fingerprint on your device, or use some other additional authentication method whenever you sign in to Webmail, in addition to entering your normal email address and password. When using the Google Authenticator app, for example, the verification code constantly changes and is obtained at the time of sign-in from the app installed on your phone or device. This means that even if someone manages to obtain your password they will still not be able to sign in to your Webmail account, because they will be unable to get the verification code. You can set up one or more of the methods below.
Authenticator App
To set up Two Factor Authentication using the Google Authenticator app:
1.Install the Google Authenticator app, or a Google Authenticator compatible app, on your phone or device.
2.Sign in to Webmail using https:// in the browser rather than http://.
3.In the Security settings, click Set up Authenticator App.
4.Enter your Current Password (required), and click Set up Authenticator App.
5.In your authenticator app, tap + and then Scan a QR code, and scan the QR code that Webmail displays.
6.If you cannot scan the QR code, click Show Secret and then enter the secret key and your email address into the app.
7.Enter the Verification Code that appears in your app, and click Verify Pairing.
Email Verification
To set up a secondary email address for receiving a verification code (emailed codes normally expire after 10 minutes):
1.Sign in to Webmail using https:// in the browser rather than http://.
2.In the Security settings, click Set up Email Verification.
3.Enter a Verification Code Email address (Note: this cannot be your Webmail email address), and enter the same address again in Confirm Verification Code Email.
4.Enter your Current Password (required), and click Set up Email Verification.
5.An email containing a verification code will be sent to the email address you provided. Enter the Verification Code, and click Verify Email. If the code does not arrive within a few minutes, click Resend Code.
To use a device for Two Factor Authentication, such as a USB security key, a fingerprint reader on your phone or laptop, or the like:
1.Sign in to Webmail using https:// in the browser rather than http://.
2.In the Security settings, click Set up Passkeys.
3.Under Register a New Passkey, choose the kind of device you wish to use, or choose Use any available authentication method.
4.Enter your Current Password (required), and click Get Started.
5.Follow the directions that appear for choosing and verifying your device.
6.When finished, the passkey is listed under Registered Passkeys. To remove a passkey from the list, click Revoke.
The Pro theme uses different names for this method: it calls it Device Authentication. To add a device, click Set up Device Authentication instead of Set up Passkeys, and look for your devices under Registered Two Factor Auth Device Credentials instead of Registered Passkeys. The steps are otherwise the same.
Changing or Disabling Two Factor Authentication
After you set up a method, its button changes to Manage Authenticator App, Manage Email Verification, or Manage Passkeys. Click it to make changes. For example, you can click Disable Two Factor Authentication to stop using your authenticator app, Change Verification Code Email or Disable Email Verification for email verification, or Revoke to remove a passkey.
App Passwords
Although Two Factor Authentication (2FA) is the best way to secure your email account when signing in to Webmail, it cannot be used in email apps, such as an email client program you use on your computer or an email app on your phone. This is because an email app must be able to check your email and receive new messages for you in the background without you having to enter a code from your authenticator app. Therefore to help make your email apps more secure, while still protecting your account password, you can use App Passwords, which are very strong, randomly generated passwords that you can use in your email clients to sign in to your account instead of using your account password. App Passwords can only be used in email apps, they cannot be used to sign in to your Webmail account from your browser.
App Password requirements and recommendations
In order to use App Passwords, you must sign in to Webmail using https:// and have Two Factor Authentication (2FA) set up for your account. They can only be used in email apps—they cannot be used to sign in to Webmail (to sign in to Webmail, use your account password with 2FA). Each App Password is displayed only once, when it is created. There is no way to retrieve it later, so you should be ready to enter it into your app when you create it. For best security, you should use a different App Password for each email app, and you should revoke (delete) its password whenever you stop using an app or when a device is lost or stolen that was using one. Further, each App Password lists when it was created, when it was last used, and the IP address from which it last accessed your email. If you find something suspicious about the Last Used or Last IP data, you should revoke that App Password and create a new one for your app. Last, when you change your account password, all App Passwords are automatically deleted—you cannot continue using old App Passwords.
Creating and using App Passwords
To create and use a new App Password, follow the steps below. Before you begin, you should have your email app or client ready to enter the password, because the App Password will only be displayed once while creating it.
1.Have your app or email client ready to enter your App Password.
2.Sign in to Webmail using https://, and in the Security settings, click Manage App Passwords.
3.Enter your Current Password (required).
4.Click New App Password.
5.Enter the name of the app that will use this password (e.g. "Phone email app"), and click OK.
6.Click Copy to clipboard and paste the password into your app, or manually enter it, or paste it into a text file or write it down if necessary. If you copy the password to use later then you should delete the copy after entering it into your email client. When finished, click Close.
Your App Passwords are listed with their name and when each was created and last used. Click Rename to rename one, or Revoke to delete it. Any app that uses a revoked App Password can no longer access your account.
Sign-in History
The Security settings also list the last ten times you successfully signed in to your account, including the type of access, the time you signed in, and the country from which you signed in.
