SuperMailOS
Start free

Security

Your mailbox is a master key. Guard it like one.

Your inbox is the reset point for most of your other accounts, so the controls to lock it down are built in — and the trust signals on the mail you receive are honest, not decorative.

Start free See pricing

Included on every plan. See all features

Inbox2FA on

Every message carries the receiver’s real verdict:

Rreceipts@stripe.comYour payout of $2,480.00 is on the way
Bbilling@paypa1-support.coAction needed: your account is on hold

The badges come straight from the receiving server’s Authentication-Results — so a spoof stands out instead of blending in.

01 What you get

Controls on your account, honesty on your mail.

Everything below is on every plan — security shouldn't be an upsell.

TOTP two-factor

Add a time-based one-time-code second factor with any authenticator app. Even if your password leaks, a sign-in still needs the rotating code from your phone.

Session control

See where your account is currently signed in and sign out a session you don't recognise — useful after a shared or borrowed machine.

Revocable app passwords

Mail clients get their own scoped password instead of your login, so two-factor stays on your account and you can revoke one device without disturbing the others.

Real authentication badges

Each message shows an SPF/DKIM/DMARC badge built from the receiving server's own Authentication-Results — a genuine pass, fail or unverified. We never claim a pass we can't back.

Bcc privacy that holds

A Bcc line is only ever shown to the sender or a recipient who was themselves Bcc'd, and Bcc never affects threading — privacy that behaves the way you expect.

Isolated system mail

Password-reset and other system email is sent from a dedicated address on its own subdomain, kept separate from tenant sending so it never touches your domain's reputation.

02 Questions

Security questions, answered.

Something else? Write to us — a real person answers, usually the same day.

Talk to us
How do I turn on two-factor authentication?+
Open Settings, then Security, choose two-factor authentication, and scan the QR code with any TOTP authenticator app. Enter the current 6-digit code to confirm, and two-factor is active on your next sign-in. Store any recovery codes somewhere safe and offline.
What is an app password and when do I need one?+
IMAP and SMTP mail clients sign in with a username and password directly, which can't complete a two-factor prompt. An app password is a separate, revocable credential scoped to one client. Generate one under Settings → Security → App passwords, use it in the mail app, and revoke it any time without touching your main login.
What do the authentication badges on a message mean?+
They reflect the receiving mail server's own SPF, DKIM and DMARC verdicts for that message. A green badge means DMARC passed (and shows which of SPF/DKIM aligned); a fail is shown as a fail; a message with no verdict is shown as unverified rather than dressed up as a pass.
How is Bcc kept private?+
A Bcc recipient is only ever visible to the sender or to another recipient who was also Bcc'd — a To/Cc recipient never sees the Bcc list. Bcc is also excluded from threading, so a blind copy can't leak through conversation grouping.

Prefer the step-by-step? The security doc walks through turning on two-factor and managing app passwords.

Lock it down in a minute.

Turn on two-factor, generate an app password for your mail client, and read every message with a real authentication verdict attached. The first 14 days are free.

Start free Talk to us