Two-factor authentication in webmail

Two-factor authentication adds a temporary code, generated by a compatible app, to interactive webmail logins. The app shows the exact period, which depends on the server configuration.

Use an app that supports the type of code the form indicates. Protect the device and, if you sync its secrets, the sync account too.

Go to the mailbox's webmail tools page and open Two-Factor Authentication if your server offers that feature. If you log in to Roundcube directly, first go back to Webmail Home.

Scan the QR code with the app and enter a temporary code in the form to confirm activation. The QR code contains the setup secret: do not send it in a screenshot or share it.

From then on, webmail will ask for the code when you start a new session. Before closing the current session, check that you can generate a valid code and save any recovery method offered.

This protection applies to the webmail login described on the screen. Do not assume that it protects IMAP, POP or SMTP connections from external apps; those connections still need a unique password and a correct TLS configuration.

If the code does not work or you change phone

Check that you are using the entry for that mailbox and that the phone's time is set automatically. Enter a recent code and avoid reusing one that has already expired.

Before retiring your old phone, set up the new method and check a login from another window. If you have lost every method, contact support through your account's channel so that we can verify ownership and review recovery. Changing the email password does not necessarily remove the second factor.