Admin Guide: Reset a TrekMail Mailbox Password

If a mailbox user (employee, family member, client) forgets their password or you need to lock out a compromised account immediately, you can reset the mailbox password directly from your TrekMail dashboard. This guide covers the two reset approaches, direct password set vs issuing a one-time access code, plus when to use each, how to deliver the new credentials safely, and what to do during a security incident.

This is the mailbox password (used in webmail, Outlook, iPhone, etc.), not the TrekMail dashboard sign-in password, which is account-owner-only and self-service.

When to do this

• A user forgot their mailbox password and didn't have a recovery code or recovery email to self-reset. Most common case.
• Security incident: you suspect a mailbox has been compromised (phishing, leaked password). You want to lock out the attacker immediately, regardless of what the legitimate owner remembers.
• Offboarding: an employee left. You want to control the mailbox going forward, so you set a password only you know (then later either delete the mailbox or transfer ownership).
• New device setup: the user wants a fresh password for a clean device setup.

Path 1: Reset directly with a known new password

The fastest path. You pick the new password, the mailbox is updated, you hand it to the user.

1. Open the Mailboxes page in your dashboard.
2. Click Manage next to the mailbox (search by address first if needed).
3. Click the Security tab. The available tabs depend on the mailbox type, plan, and status.
4. In the Mailbox password card, type the New password twice, or click Generate strong password under the field to create a random one.
5. Click Save password.

The button only enables once your new password meets every requirement. After the mail-server update succeeds, the old password stops working for new webmail, IMAP, and SMTP sign-ins. Update mail apps and scripts with the new password before expecting them to reconnect.

Password requirements (live-checked, all four green checks must pass):

• At least 12 characters.
• At least one uppercase letter.
• At least one lowercase letter.
• At least one number.

Click Generate strong password if you'd rather not invent one. We produce an 18-character mix of upper / lower / digits / a small safe symbol set, no visually-confusing characters like i, l, 0, or O. The result is auto-filled in both fields and revealed so you can copy it before saving.

The old key-icon shortcut in the mailbox list was removed in the May 2026 redesign; the Security tab is now the single place to do this from the dashboard. See Mailbox Security for the rest of what lives on that tab.

Path 2: Issue a one-time recovery code for self-service reset

Useful when:

• You don't want to know the user's new password (the user picks it themselves).
• You're remote / async and prefer the user complete the reset on their own time.
• You need an audit trail of "user reset themselves with admin permission" rather than "admin set the password".

1. Open the mailbox settings → Security tab (same place as Path 1).
2. Scroll to the Recovery code card.
3. Click Generate new code. The new code is shown once in the dialog. Copy it before closing; it expires after 24 hours.
4. Send the code to the user via a secure channel (see "Delivering the new password safely" below).
5. The user goes to the webmail login page, selects Forgot password?, chooses Recovery code, enters the code, and sets their own password.

The code is single-use. After the user redeems it, it's consumed; subsequent attempts to use the same code fail.

If the user loses the code or does not use it in time, issue another. A newly generated code replaces the previous one.

Path 3: Use the recovery email (user-side flow)

If the mailbox has a recovery email configured (set during mailbox creation or by the user in webmail settings), the user can reset on their own without you doing anything. They go to the webmail login → Forgot password? → Recovery email mode → enter their TrekMail address → receive a reset link in their recovery inbox.

This is the most hands-off approach for you. Encourage users to set a recovery email when they first log in. It eliminates support tickets.

Delivering the new password safely

Whichever path you choose, you'll need to communicate something (a password or a code) to the user. Don't email it in plaintext.

Safe channels:

• Password manager sharing (1Password Teams, Bitwarden Send), encrypted, expires after view.
• Signal, WhatsApp, iMessage: end-to-end encrypted DM.
• Bitwarden Send / similar: generate a one-time link that destroys after first view.
• In person / over phone: fine for short codes or generated passwords.

Avoid:

• Plain email: readable if the user's inbox is compromised, exactly the situation you're often trying to fix.
• Slack public channels: long retention, searchable by anyone in the workspace.
• SMS: fine for short codes but be aware SMS isn't end-to-end encrypted.

What happens immediately on a password reset

• Old password stops working for new IMAP, SMTP, and webmail sign-ins after the update succeeds. Stale clients begin to fail authentication until they are updated.
• Active webmail sessions are not automatically signed out by an administrator password change. If you suspect a stolen session, suspend sign-in and contact support or follow your incident-response process rather than deleting and recreating the mailbox as a default step.
• No emails are lost. Everything in the mailbox (inbox, sent, folders, rules, contacts) is preserved. Only authentication credentials change.

During a security incident

If you believe a mailbox has been compromised, do all of this:

1. Reset the password (Path 1) with a strong generated password. Use a value the user doesn't know yet.
2. Generate a new recovery code. This invalidates earlier mailbox-password recovery codes, including a legacy code left from older mailbox setup.
3. Suspend sign-in for the mailbox if you need to stop access while you investigate. Keep the mailbox intact so its messages and settings remain available for review.
4. Review mail rules and forwards on the mailbox, attackers often set forwarding to their own address to siphon copies of future mail. Look in webmail or via Mail Rules.
5. Check Sent folder for messages the attacker may have sent in the user's name. Delete them if they're spam/phishing; otherwise document for forensics.
6. Notify the user through a secondary channel (their phone, in person). Explain what happened.
7. Reset 2FA only when needed and have the mailbox owner enroll their own authenticator again. Mailbox 2FA protects webmail sign-ins; keep administrator dashboard security separate.

Common mistakes after the reset

• User goes to the dashboard URL instead of webmail with their new mailbox password. The dashboard wants the account-owner password, not the mailbox password. Make sure the user knows: webmail is at https://trekmail.net/webmail/login (or your branded URL); the dashboard starts at https://trekmail.net.
• User updates Outlook but Outlook keeps using cached old password. Windows Credential Manager (Control Panel → Credential Manager → Windows Credentials) can cache IMAP/SMTP credentials. Remove the entries for the incoming and outgoing hosts shown under Apps & devices, then test the new password again.
• Phone keeps showing "couldn't verify password" notification. Re-add the mail account on the phone, don't just update password, some mobile clients (older Apple Mail builds especially) handle credential update poorly.

What you can't do

• You can't see the user's existing password: passwords are hashed; we don't store recoverable cleartext. The only way to "tell a user their password" is to set a new one (Path 1) or issue a code (Path 2).
• You can't reset a password for a mailbox on another account: admins can only reset mailboxes on accounts they own/admin.
• You can't bypass password complexity even with Path 1. The same requirements apply: at least 12 characters with uppercase, lowercase, and a number. The Generate button produces a compliant password.