SuperMailOS
Start free

Security

Your mailbox is a master key. Guard it like one.

Your inbox is the reset point for most of your other accounts, so the controls to lock it down are built in — and the trust signals on the mail you receive are honest, not decorative.

Start free See pricing

Included on every plan. See all features

Where you're signed in2FA on

Sign out any device you don't recognise.

Chrome on macOSThis device

203.0.113.24 · last active just now

SuperMailOS on iPhone

198.51.100.7 · last active 2h ago

Firefox on Windows

192.0.2.181 · last active 5m ago

Sign out

Every device signed in to your account, and a Sign out for the one you don't recognise. With two-factor on, a leaked password alone doesn't get anyone in.

01 What you get

Controls on your account, honesty on your mail.

Everything below is on every plan — security shouldn't be an upsell.

TOTP two-factor

Add a time-based one-time-code second factor with any authenticator app. Even if your password leaks, a sign-in still needs the rotating code from your phone.

Session control

See where your account is currently signed in and sign out a session you don't recognise — useful after a shared or borrowed machine.

Revocable app passwords

Mail clients get their own scoped password instead of your login, so two-factor stays on your account and you can revoke one device without disturbing the others.

Honest sender details

An email's details show where a reply would go and which server handed it over, and Show original has every header. No “verified” badges on outside mail we can't verify: we only show what we can back.

Bcc privacy that holds

A Bcc line is only ever shown to the sender or a recipient who was themselves Bcc'd, and Bcc never affects threading — privacy that behaves the way you expect.

Isolated system mail

Password-reset and other system email is sent from a dedicated address on its own subdomain, kept separate from tenant sending so it never touches your domain's reputation.

02 Questions

Security questions, answered.

Something else? Write to us — a real person answers, usually the same day.

Talk to us
How do I turn on two-factor authentication?+
Open Settings, then Security, choose two-factor authentication, and scan the QR code with any TOTP authenticator app. Enter the current 6-digit code to confirm, and two-factor is active on your next sign-in. Store any recovery codes somewhere safe and offline.
What is an app password and when do I need one?+
IMAP and SMTP mail clients sign in with a username and password directly, which can't complete a two-factor prompt. An app password is a separate, revocable credential scoped to one client. Generate one under Settings → Security → App passwords, use it in the mail app, and revoke it any time without touching your main login.
How can I tell who really sent an email?+
Like Gmail, an email's details show where a reply would go (its reply-to), the “via” line shows which server actually handed it over, and Show original has the full headers. Anything that looks wrong is one click from Report spam. What you won't see is a “verified” badge on outside mail: our mail server doesn't hand us a verdict on who really sent it, so we don't claim one. “Verified sender” appears only on mail someone in your own workspace sent from their mailbox.
How is Bcc kept private?+
A Bcc recipient is only ever visible to the sender or to another recipient who was also Bcc'd — a To/Cc recipient never sees the Bcc list. Bcc is also excluded from threading, so a blind copy can't leak through conversation grouping.

Prefer the step-by-step? The security doc walks through turning on two-factor and managing app passwords.

Lock it down
in a minute.

Turn on two-factor, generate an app password for your mail client, and see every device signed in to your account. The first 14 days are free.

Start free Talk to us