[SuperMailOS](/)

[Product](/#product)[Agents](/agents)[Pricing](/pricing)[Compare](/compare)[Tools](/tools)[Docs](/docs)

[Log in](/login)[Start free](/signup)

DocsSecurity: 2FA & sessions

Getting started

-   [Overview](/docs)
-   [Set up your domain’s DNS](/docs/dns-setup)
-   [Connect a mail app (IMAP/SMTP)](/docs/connect-mail-app)
-   [Migrate your existing mail](/docs/migrate)

Running your mail

-   [Deliverability & inbox placement](/docs/deliverability)
-   [Security: 2FA & sessions](/docs/security)

Developers

-   [API reference](/docs/api)
-   [Webhooks](/docs/webhooks)
-   [Connect your AI (MCP)](/docs/mcp)
-   [Agent inboxes](/docs/agents)

Resources

-   [Guides](/learn)
-   [Email checker](/tools/email-checker)
-   [System status](/status)
-   [Changelog](/changelog)

Getting started

-   [Overview](/docs)
-   [Set up your domain’s DNS](/docs/dns-setup)
-   [Connect a mail app (IMAP/SMTP)](/docs/connect-mail-app)
-   [Migrate your existing mail](/docs/migrate)

Running your mail

-   [Deliverability & inbox placement](/docs/deliverability)
-   [Security: 2FA & sessions](/docs/security)

Developers

-   [API reference](/docs/api)
-   [Webhooks](/docs/webhooks)
-   [Connect your AI (MCP)](/docs/mcp)
-   [Agent inboxes](/docs/agents)

Resources

-   [Guides](/learn)
-   [Email checker](/tools/email-checker)
-   [System status](/status)
-   [Changelog](/changelog)

[Home](/)[Docs](/docs)Security: 2FA & sessions

Security

Copy page[.md](/docs/security.md "Open this page as Markdown")

# Security: 2FA & sessions

Updated 6 Sep 2026

On this page 4 sections

-   [Two-factor authentication (TOTP)](#two-factor-authentication-totp)
-   [App passwords for mail clients](#app-passwords-for-mail-clients)
-   [Sessions](#sessions)
-   [Password resets](#password-resets)

Your mailbox is the reset point for most of your other accounts, so SuperMailOS gives you the controls to keep it locked down: two-factor authentication, visibility over active sessions, and separate app passwords for mail clients.

## Two-factor authentication (TOTP)

Two-factor authentication adds a second step to sign-in: even if your password leaks, an attacker still needs the rotating code from your authenticator app.

1.  **Open *Settings → Security*.**
2.  **Start two-factor setup** and scan the QR code with any TOTP authenticator app.
3.  **Confirm** by entering the current 6-digit code. Once it’s accepted, two-factor is active on your next sign-in.

If your provider offers recovery codes during setup, store them somewhere safe and offline — they’re how you get back in if you lose your authenticator.

## App passwords for mail clients

Apple Mail, Outlook and other IMAP/SMTP apps sign in with a username and password directly, which doesn’t fit a two-factor prompt. The answer is an **app password**: a separate, revocable password scoped to one client. Generate one under *Settings → Security → App passwords*, use it in the mail app in place of your login password (see [connect a mail app](/docs/connect-mail-app)), and revoke it any time without touching your main login.

## Sessions

Your security settings show where your account is currently signed in. If you see a session you don’t recognise — or you’ve signed in on a shared machine — sign it out there, and change your password if anything looks off.

## Password resets

Password-reset and other system mail is sent from a dedicated system address on its own subdomain, kept separate from tenant sending so it never affects your domain’s reputation. If a reset email doesn’t arrive, check spam and confirm the address on your account.

Next: [deliverability & inbox placement](/docs/deliverability) or [migrate your existing mail](/docs/migrate).

Was this page helpful?

YesNo

[← PreviousDeliverability & inbox placement](/docs/deliverability)[Next →API reference](/docs/api)

Stuck?

Write to [hello@supermailos.com](mailto:hello@supermailos.com). A person who can fix it reads every message.

[SuperMailOS](/)

Every domain you own, in one beautiful inbox. From $3 a mailbox.

Product

-   [Tour](/#product)
-   [Pricing](/pricing)
-   [Features](/features)
-   [Phone apps](/#iphone)
-   [Agent inboxes](/agents)
-   [MCP & API](/features/ai-agents)
-   [Changelog](/changelog)

Compare

-   [Google Workspace](/compare/google-workspace)
-   [Microsoft 365](/alternatives/microsoft-365-alternative)
-   [Zoho Mail](/compare/zoho)
-   [Fastmail](/compare/fastmail)
-   [AgentMail](/compare/agentmail)
-   [Cost calculator](/tools/email-cost-calculator)
-   [All comparisons](/compare)

Resources

-   [Docs](/docs)
-   [Developers](/docs/api)
-   [Learn](/learn)
-   [Use cases](/use-cases)
-   [Free tools](/tools)
-   [Glossary](/glossary)
-   [Status](/status)

Company

-   [About](/about)
-   [Contact](/contact)
-   [Brand](/brand)
-   [Privacy](/privacy)
-   [Terms](/terms)
-   [Refunds](/refund)
-   [Security](/security-policy)

More from Adee Labs

-   [SuperSplit](https://supersplit.app)Split expenses with friends
-   [SuperDiffs](https://www.superdiffs.com)AI code review for GitHub
-   [Image2Vector](https://image2vector.app)Image to SVG converter
-   [Adee Labs](https://adeelabs.com)Independent product studio

© 2026 SuperMailOS · Built by [Adee Labs](https://adeelabs.com)Every domain · one inbox