Fastmail Security: Two-Step Verification, Passkeys and App Passwords
Secure your Fastmail account with two-step verification (authenticator app, security key or OTP device), app passwords for Apple Mail and Outlook, trusted devices and recovery options.
Fastmail's security settings are all under Settings › Privacy & Security. The essentials: turn on two-step verification, give every email app its own app password, and keep your recovery options current.
Turn on two-step verification
- Go to Settings › Privacy & Security. If it's your first time, you'll be asked to add a recovery phone number before you can continue.
- Under Password & Two-step verification, select Manage two-step verification, then Add verification device.
- Pick a method and follow the steps.
| Method | Notes |
|---|---|
| Security key (WebAuthn/U2F) | A hardware key you plug in and touch. Tied to Fastmail's domain, so it resists phishing. |
| Authenticator app (TOTP) | Any standard authenticator app on your phone. |
| OTP hardware token | A standalone code-generating device — no phone or USB port needed. |
| Yubico OTP | For older YubiKeys that don't support WebAuthn/U2F. |
| SMS | Backup only — available once you already have an app or security device set up. |
You can also sign in with a passkey, using your device's PIN, fingerprint or face.
Trusted devices
When you log in, you can mark a computer as trusted so it won't ask for a code again. Revoke trust from Privacy & Security whenever you stop using a device; it will then need two-step verification at the next login.
App passwords for other email apps
Apple Mail, Outlook, Thunderbird and phone mail apps can't use your normal password or two-step codes — each needs an app password. (The Fastmail app doesn't.)
- In Settings › Privacy & Security, under Connected apps & API tokens, select Manage app passwords and access.
- Select New app password and confirm your password if asked.
- Name it after the device or app.
- Choose access: Mail, Contacts & Calendars (the default — covers IMAP, POP, SMTP, CardDAV and CalDAV), or Files (WebDAV) for file apps.
- Select Generate password and paste it into the app.
To stop an app, return to Manage app passwords and access and Disable or Remove its password — removing can't be undone. Basic plans can't create app passwords, because they don't include access from other email apps.
Keep recovery options current
Under Settings › Privacy & Security › Account recovery, keep a recovery phone and email up to date and store your recovery code safely. It's what lets you reset your password if you lose your two-step device. Fastmail recommends reviewing these regularly.
Locked out? See resetting your Fastmail password.
How this guide was checked · October 2026
Verified against 4 official sources
Every step, setting and limit in this guide was checked against the provider’s own documentation on fastmail.help. Anything we couldn’t confirm was left out.
Questions
Frequently asked questions
How do I turn on two-step verification in Fastmail?
Settings › Privacy & Security › Manage two-step verification › Add verification device. You'll need a recovery phone number first.
How do I create a Fastmail app password?
Settings › Privacy & Security › Manage app passwords and access › New app password, choose Mail, Contacts & Calendars, and select Generate password.
Can I use SMS for Fastmail two-step verification?
Only as a backup, once you've already set up an authenticator app or security device.
Why can't I create an app password in Fastmail?
Basic plans don't include access from other email apps, so app passwords aren't available. Upgrade to Individual or above.
Related guides
Keep reading
Fastmail Troubleshooting
Fastmail Not Receiving Email? Fixes for Mail, Domains and Email Apps
Fastmail not receiving or syncing? Check status, billing and storage, spam and blocked senders, custom-domain MX records and app passwords, plus fixes for common Outlook and certificate errors.
3 min read
Fastmail Password Reset
How to Reset Your Fastmail Password
Reset a forgotten Fastmail password with the account recovery tool, why resets from new devices wait 24 hours, and how to change your password and set up recovery options.
3 min read
Fastmail Login
Fastmail Login: How to Log In to Fastmail
Log in to Fastmail at app.fastmail.com with the address you signed up with, use two-step verification and passkeys, and fix locked accounts, forgotten usernames and app sign-in errors.
3 min read
Fastmail Sign Up
Fastmail Sign Up: How to Create a Fastmail Account
Sign up for Fastmail with a 30-day trial, choose the right plan — Individual, Duo, Family or Basic — and know the storage, custom-domain and trial limits before you pay.
3 min read
Fastmail Settings
Fastmail Server Settings: IMAP, SMTP and POP3
Fastmail IMAP, SMTP and POP3 settings, authentication requirements and provider-specific connection fixes in one verified guide.
3 min read
Yandex Mail Security
Yandex Mail Security: Yandex Key, App Passwords and Sessions
Protect your Yandex Mail with two-factor authentication, app passwords for email programs, a recovery phone and the log-out-everywhere switch.
3 min read