Hushmail Security: Two-Step Verification and Safe App Access

Hushmail is built around encrypted email, but the account itself is only as safe as your sign-in. These are the steps that matter most.

1. Treat your password as irreplaceable

For personal accounts, Hushmail can't reset a lost password — so a strong, unique password stored in a password manager is both your best protection and your only way in. On custom-domain business accounts an administrator may be able to reset it. Changing it: Preferences → About You → Password. See Hushmail password reset.

2. Turn on two-step verification

1. Sign in, open the menu in the upper-right corner and choose Preferences.
2. Select the Security tab and click the pencil icon to turn on two-step verification.
3. Click Continue and follow the instructions on screen.

Codes can arrive by text message, by email to a backup address or through a smartphone app. The first time you sign in on each device you'll enter a code, which registers that device.

3. Keep the backup verification code safe

After two-step verification is on, Hushmail gives you a backup verification code. It's how you get in if you can't receive codes by phone or backup email. Store it away from your phone — in a password manager or on paper somewhere secure.

4. Connect email programs with the security code

With two-step verification on, Outlook, Apple Mail and phone apps sign in with your password plus a 20-character security code: your password, a space, then the code shown under Preferences → Security in the section for desktop and mobile apps. Type it with no trailing space, and in both the incoming and outgoing settings if the program asks twice. Connection details: Hushmail server settings.

5. Know what encryption covers

An IMAP or SMTP connection encrypts the trip between your program and Hushmail, but it doesn't make every message end-to-end encrypted. Messages sent from a third-party program normally go out as ordinary email unless the recipient is a Hushmail user or has an established encryption passphrase. For sensitive messages, send through Hushmail's own encryption workflow and check how the message was delivered.

6. Protect your domain from spoofing

If you use Hushmail with your own domain, set up DKIM and DMARC as Hushmail describes, alongside SPF. Then run our SPF, DKIM and DMARC checker to confirm all three records are published correctly.