# Two-step verification and app passwords

Add a code from an authenticator app to your sign-in, and give each mail app a password of its own that you can revoke.

## Turn on two-step verification

1. In webmail, open Settings → Security → Two-step verification, and confirm your mailbox password.
2. Scan the QR code with an authenticator app, or type the key shown next to it.
3. Enter the six-digit code the app shows to confirm.
4. Save the ten recovery codes somewhere safe. They are shown only this once.

When turning it on you can sign out your other webmail sessions at the same time; the box is ticked by default.

## What changes afterwards

- Webmail asks for your password, then for a code from the authenticator app.
- Mail apps no longer sign in with the mailbox password alone, over IMAP, SMTP, CalDAV or CardDAV. Give each app an app password (below). This is enforced by the mail server itself, so a leaked password is not enough anywhere.
- A recovery code can be used in place of a code on the webmail sign-in page, once each. After signing in with one, webmail asks you to set up a new authenticator.
- Replacing the authenticator needs a current code; turning two-step verification off needs your password and a code or a recovery code.
- After 20 wrong codes within a day, codes stop working for the mailbox until you sign in with a recovery code or we reset two-step verification for you.

## App passwords

An app password is a separate password for one mail app. Create them in webmail under Settings → Security → App passwords: give it a name, optionally an expiry date, and a scope.

- **Scopes**: All mail clients; Mail only (IMAP / SMTP); or Calendars & contacts.
- Creating one needs your mailbox password and, with two-step verification on, a current code.
- The password is shown once, with a copy button. If you lose it, revoke it and create another.
- Revoke an app password at any time, for example when a device goes missing; your mailbox password and your other apps are not affected.
- A mailbox can hold a limited number of app passwords; the card shows how many are in use.
- App passwords work with or without two-step verification, and never sign in to webmail.

## Lost the authenticator and the recovery codes

Write to [support@abnormalhq.com](mailto:support@abnormalhq.com) and tell us the mailbox address and, if you bought the plan, the order number. Once we have verified that the mailbox is yours, we reset two-step verification so you can sign in with your password and turn it on again. Never send us your password or codes.

## Not the article you were looking for?

Go back to the help center and search again, or write to us and we'll help directly. Include your mailbox address or order number, never a password.

- [Browse all help articles](https://abnormalhq.com/md/help/)
- [Email support](mailto:support@abnormalhq.com)