Repository navigation
Two Step Sign In
Every user can turn it on under ⚙ → Sign-in security. The login cookie is issued only after the second step.
| Method | Notes |
|---|---|
| Authenticator app (TOTP) | any standard app |
| Passkeys | Face ID, Touch ID, Windows Hello, security keys |
| Code mailed to a backup address | sent through the user's own mailbox |
| One-time recovery codes | shown once; keep them safe |
Passkeys can also sign in without a password (per passkey, on by default). The server then keeps an encrypted copy of the mail password for that passkey; it is refreshed on the next password sign-in after a password change.
A passkey belongs to a host name (a WebAuthn rule). Behind a proxy keep the original Host header (ProxyPreserveHost On in Apache) or set GOODMAIL_ORIGIN=https://mail.example.com. With several host names do not set GOODMAIL_ORIGIN, see Several Domains.
The Administration dialog warns when an administrator has no two-step sign-in, because administrators can create and delete mailboxes.
goodmail
Using it
Security
Running it