Mailbox Security: Password, Recovery Code, 2FA

Every regular TrekMail mailbox has a Security tab on its settings page. This is where you change the password, manage mail app sign-in and app passwords, generate a fresh recovery code, and check two-factor authentication. Shared mailboxes have no direct login, so their settings show Access instead.

This page is for the account admin setting things up from the dashboard. If you own a mailbox and want to change your own password without bothering the admin, see Change Your Own Mailbox Password.

How to get there

1. Open the Mailboxes page in your dashboard.
2. Click Manage next to a regular mailbox.
3. Click the Security tab. The other tabs vary by mailbox type, plan, and status.

The tab includes Two-factor authentication, Mailbox password, Mail app sign-in, App passwords, and Recovery code.

Two-factor authentication

This section shows whether 2FA is on for the mailbox. The status is also reflected in the page header, a green "2FA on" pill means it's enabled, a muted "2FA off" link means it's not.

2FA is configured by the mailbox owner from inside webmail, not from the dashboard. The owner scans and confirms their own authenticator-app secret. An authorized administrator can reset 2FA when the owner is locked out, but cannot turn it on for them. To enable or disable 2FA:

1. The mailbox owner signs in at TrekMail webmail (or your tenant's branded URL).
2. From the webmail settings, they enable 2FA and scan the QR code with an authenticator app (Google Authenticator, 1Password, Authy, etc.).
3. Once confirmed, return to the Security tab or refresh it to see the new status.

After 2FA is on, new regular webmail sign-ins require the mailbox password and a TOTP or 2FA recovery code. Mail apps and classic webmail never ask for a code. Enabling 2FA offers Also require app passwords for mail apps, on by default.

Mail app sign-in and app passwords

• App passwords only (Recommended): IMAP, SMTP, calendars and contacts need an app password. The mailbox password still opens regular webmail. Classic webmail uses an app password.
• Mailbox password or app passwords: mail apps accept either. Existing mailboxes keep this mode at rollout.

New mailboxes follow Account settings > New mailboxes > Mail apps need app passwords, on by default. Changing it does not switch existing mailboxes. Use Mail app sign-in here to change a mailbox in either direction; requiring app passwords asks for confirmation and signs out apps using the mailbox password. A mailbox user can switch only to App passwords only in webmail; switching back needs an admin.

Under App passwords, anyone allowed to set the mailbox password can choose Create app password, Replace, or Revoke. Read-only members can view the list. Users manage their own list in Settings, App passwords in webmail. Give each app or device its own named password, up to 25 active passwords per mailbox. Each is shown once. Replace ends the old password immediately; Revoke signs out that app.

Password resets or recovery, sign-in suspension, conversion to shared, and moving to Recently deleted revoke all app passwords. Restoring a mailbox does not restore them. A user changing their own password in webmail can select Also revoke all app passwords (off by default). See Mail app passwords.

Mailbox password

The password section has a single form: enter a new password twice and click Save password. The form is the only way to set a mailbox password from the dashboard today, the old inline "key icon" shortcut in the mailbox list was removed in the May 2026 redesign.

Requirements (live-checked as you type):

• At least 12 characters
• At least one uppercase letter
• At least one lowercase letter
• At least one number

The Save button stays disabled until all four green checks are met.

If you'd rather not invent a password yourself, click Generate strong password under the input. We generate an 18-character mix of upper, lower, digits, and a small symbol set, no visually-confusing characters (i, l, 0, O, etc.). It's pasted into both fields automatically and revealed so you can copy it.

What changes after a successful save:

• The previous mailbox password stops working for new sign-ins. An admin setting a new password here, through the API, or through an AI agent automatically revokes all app passwords. Create new ones for Outlook, phones and scripts, or use the new mailbox password where it is still accepted.
• Trusted-device access is revoked. Existing webmail sessions are not automatically closed by an administrator password change, so use a mailbox suspension or other incident response steps if an active session is a concern.
• Mail in the mailbox is unaffected. No messages or folders are deleted.

If you're resetting because of a suspected compromise, this is the lock-out moment.

Recovery code

A recovery code is a one-time string that lets the mailbox owner reset their password when they cannot use the current one. It does not sign them in directly or replace their separate 2FA recovery codes.

The card shows:

• When the current active code was issued (e.g. "Issued 3 hours ago"), or "Not issued yet" when no usable code remains.
• A Generate new code button.

Clicking Generate opens a confirmation dialog and then displays the new code once in the dialog. Save it immediately. Once you close the dialog there is no way to retrieve it. The code expires after 24 hours; generating a new one invalidates all earlier mailbox-password recovery codes, including a legacy code saved during older mailbox setup.

Hand the code to the user through a secure channel (password manager Send link, Signal, in person). The user then uses it on the webmail "Forgot password?" page, Recovery code mode, to set a new password themselves.

If we stop a mailbox from sending

We watch the mail leaving every mailbox. If outgoing activity suggests that a mailbox password has been misused, we can stop that one mailbox from sending and leave everything else alone. Mail still arrives, the owner can still sign in and read, other mailboxes on the account are untouched, and your domain's reputation is protected.

It is a safety catch, not a punishment, and we will be in touch about it.

What to do:

1. Change the mailbox password using the form above. This is the step that actually locks the other person out, stopping the sending only buys time.
2. Reconnect each phone, mail app, or SMTP script with a new app password, or the new mailbox password if the mailbox still accepts it.
3. Tell support you have done it, from the Support page. We switch sending back on; you cannot do that part yourself, by design.

While it is in force the mailbox behaves normally in every other respect, and anything written in webmail can be saved as a draft and sent once sending is back.

A few good habits

• Use a different password than your TrekMail dashboard sign-in. A compromised mailbox should not let anyone into your billing or other mailboxes.
• Keep the recovery code in a password manager. Not your inbox, not a sticky note, a manager that's separate from the mailbox you're protecting.
• Turn on 2FA for high-value regular mailboxes. Shared mailboxes do not sign in directly, so protect them by keeping each member's own mailbox secure.

What's not on this tab

Some things you might expect here actually live elsewhere, by design:

• Forwarding rules: Forwarding has its own tab. It is routing, not security.
• Allowed senders / blocked senders: Filters tab. The Security tab is intentionally narrow to keep "who can sign in" separate from "what comes in."
• Delete mailbox: the trash icon in the page header, top right. Sits next to Edit storage and is plan-side, not security-side.
• Account-owner sign-in 2FA: that's a different setting on Account, Security, not on the mailbox itself. The two are independent: an account-owner can have 2FA on for the dashboard while individual mailboxes don't.