I Forgot My Mailbox or Account Password

TrekMail has two different passwords, and they reset differently. Most "I'm locked out" cases are actually "I'm trying the wrong password in the wrong place." This guide walks both flows, including the less-obvious recovery paths.

The two passwords

Before you reset anything, identify which one you've forgotten:

• Account password — what you use to sign in to the TrekMail dashboard (the page where you manage domains, mailboxes, billing, settings). One per account. Tied to your sign-in email.
• Mailbox password — what you use to sign in to webmail or to add the mailbox to an email client (Outlook, Apple Mail, iPhone, etc.). One per mailbox. Tied to that specific email address (e.g. alice@yourcompany.com).
• Drive device password — what a Drive sync app (rclone, Finder, Cyberduck, DAVx⁵, Documents by Readdle) uses to connect to your Drive. Starts with dsync_, generated one per device on the Sync devices page (dashboard) or from the Sync devices button inside webmail Drive. Shown once at creation, never recoverable — if you lose it, just revoke the row and create a new one.

These are three separate secrets. You can have a different password for each mailbox, and none of them are connected to your dashboard password. Device passwords are independent again — losing a sync device password doesn't affect anything except that one sync app.

If you've been trying your dashboard password in webmail and it isn't working — that's why. Use the mailbox password (or follow the reset flow below). And if a sync app is asking for a password, it wants a dsync_… device password, not the mailbox or account password.

Resetting the account password (dashboard)

1. Open your dashboard URL:
   • For most users: trekmail.net and click Sign In.
   • If you have White Label Lite: your branded domain (e.g. app.yourbrand.com). The reset flow lives there too — the same view is auto-rendered with your brand colours.
2. Click Forgot Password.
3. Enter your sign-in email. A reCAPTCHA may verify you in the background; if it scores you poorly (rare; usually only happens with weird VPN setups), you may be asked to complete a visible checkbox challenge.
4. Click Send reset link. You'll see "We have emailed your password reset link." regardless of whether the email exists — this is intentional, to prevent attackers from probing for valid accounts.
5. Check your inbox at that email address. The reset email arrives within seconds and contains a link valid for 60 minutes.
6. Click the link, type a new password twice, save. You're signed in automatically.

Common gotchas:

• The reset email may land in spam — especially if you're using a Gmail address and we've been triggered for a lot of reset emails recently. Check spam folder.
• The reset link expires after 60 minutes. If you wait too long, request a new one.
• If your email is invalid (typo on signup), no reset email ever arrives — contact support.
• If you sign in with Google/Microsoft/Facebook/X and never set a TrekMail password, the reset flow won't work. Instead, sign in via your social provider and then optionally set a password under Account → Password using the Send me a password setup link button.

Resetting a mailbox password — three ways

For mailbox passwords there are three different recovery paths. Try them in this order.

Path 1: You're the account admin

If you're the owner of the TrekMail account that holds the mailbox (this is the case if you created the mailbox or you've inherited admin), the simplest path is:

1. Open the Mailboxes page.
2. Find the mailbox you need to reset.
3. Click the Key icon next to it (or open the mailbox detail page → Change Password).
4. Set a new password, click Save.

The new password becomes effective on both webmail and IMAP/SMTP within about a minute. Walk-through: Changing a Mailbox Password as Admin.

This is the easiest path. The other two are for mailbox users who don't have dashboard access.

Path 2: You have a recovery code (or one-time access code)

When a mailbox is created via invite or when an admin grants you a self-service reset link, you may have:

• A one-time access code sent to you in an email (TrekMail issues these on request).
• A recovery code that was shown once when you set up the mailbox.

Use either to reset without admin help:

1. Go to the mailbox password reset page — visible from webmail's login screen under "Forgot password?" or directly at https://webmail.trekmail.net/password-reset (or your branded webmail if you have White Label).
2. Enter your mailbox address (alice@yourcompany.com).
3. Select Recovery code mode.
4. Paste the code, set a new password twice, click Reset.

The code is consumed on use — one reset per code. If you need to reset again later, request another code or use a different method.

Walk-through: Mailbox Owner: Change Password Yourself.

Path 3: You have a recovery email set on the mailbox

If a recovery email is configured on the mailbox (e.g. alice.personal@gmail.com as a backup), you can request a password reset link via that email:

1. Go to the mailbox password reset page (same URL as Path 2).
2. Enter your mailbox address.
3. Select Recovery email mode.
4. Click "Send link".
5. The reset link arrives in your recovery email. Click it, set new password.

A few important notes:

• The mailbox reset page always shows "We sent a link" regardless of whether the recovery email is actually configured. This is anti-enumeration protection — an attacker can't probe to learn which mailboxes have which recovery emails.
• If your recovery email isn't actually configured, you won't receive a link — that's the gap. Try Path 4.

Path 4: Knowing your current mailbox password (you don't, but the form still has the option)

There's also a "current password" mode on the mailbox reset page. That's for users who do remember their current password but want to change it — not for forgetfulness recovery.

Path 5: Admin reset (if all else fails)

If you're a mailbox user without admin access, you remember neither current password nor recovery code, and either don't have a recovery email or didn't receive the link:

• Ask the account admin (the person who created the TrekMail account / mailbox) to reset the password for you via Path 1.
• The admin can also set you up with a one-time access code (Path 2) for self-service.

What happens to your data when you reset

For mailbox passwords:

• All email messages in your mailbox are preserved.
• All folders and labels stay.
• All mail rules / Sieve filters / auto-replies stay configured.
• All IMAP/SMTP-connected clients stop working until they're updated with the new password. Update each client to the new password to restart syncing.

For account passwords:

• All your mailboxes are preserved.
• All billing history and subscriptions are unaffected.
• Active API tokens stay valid (resetting account password doesn't revoke them).
• Other active dashboard sessions stay signed in — the reset only updates the password, doesn't sign you out elsewhere. If you suspect someone else has access, change the password AND sign out of other sessions if your dashboard offers that option.

2FA after a password reset

If you have 2FA enabled and reset your account password, 2FA stays enabled. Your new password is half the auth equation; your authenticator app provides the other half.

If you've also lost access to your 2FA authenticator (lost phone, etc.):

• Use a recovery code if you saved any during 2FA setup. Each code is single-use.
• If you have neither password nor any recovery code, open a support ticket from a different email and we'll do an identity-verification flow before disabling 2FA — typically takes a few hours.

Common mistakes

• Trying the account password in webmail. Won't work. Webmail wants the mailbox password.
• Trying a mailbox password in the dashboard. Won't work either.
• Using an expired reset link. Reset links expire 60 minutes after issue. Request a new one.
• Resetting too many times in a row. We rate-limit reset requests by email and by IP. After about 5 requests for the same email within an hour, further requests get throttled. Wait a bit, try again.
• Pasting the link into a different browser than the one that requested it. Usually works, but some auth flows tie sessions to the originating session. If it doesn't work, request a fresh link from the new browser.