Zoho Mail Security: Multi-Factor Authentication and App Passwords
Protect your Zoho Mail account: turn on multi-factor authentication (OneAuth, authenticator app, SMS or YubiKey), create app passwords for email apps, and check device sign-ins.
Everything that protects your Zoho Mail lives in your Zoho account at accounts.zoho.com. The three settings worth doing today are multi-factor authentication, app passwords for any email apps you use, and a look at which devices are signed in.
Turn on multi-factor authentication
- Sign in at accounts.zoho.com.
- Open Multi-Factor Authentication in the left-hand menu.
- Choose a method and select Setup Now (for OneAuth, follow the prompts to install the app):
| Method | How it works |
|---|---|
| Zoho OneAuth | Zoho's authenticator app: approve a push notification, use Face ID / Touch ID, scan a QR code, or read a time-based code. Works offline and supports backup devices. |
| Time-based OTP | Codes from OneAuth or another authenticator app such as Google Authenticator. |
| Mobile-based OTP | Codes sent by SMS. The number can't be the same as your account recovery number. |
| YubiKey | A physical security key you touch to sign in. |
After you turn it on, Zoho gives you a set of recovery codes. Keep them somewhere safe and offline: they let you sign in if you lose your phone or key.
Create app passwords for email apps
With multi-factor authentication on, Outlook, Apple Mail, Thunderbird and other IMAP or POP apps can't use your normal password. Give each one its own app password:
- At accounts.zoho.com, open Security, then App passwords.
- Select Generate New Password.
- Name it after the app or device (for example “Outlook – work laptop”) and select Generate.
- Copy the password straight away and paste it into the app, without spaces. Zoho shows it only once.
App passwords are 12 characters long. Zoho recommends using them for email apps even when multi-factor authentication is off, so a leaked app password never exposes your main one. Users who sign in through SAML need them for IMAP or POP too. The app's server settings are in Zoho Mail server settings.
Check where you're signed in
- Device Sign-ins (under Security) lists every device and browser that has signed in, with times. Select a device to end a session you don't recognise.
- Changing your password gives you the option to end all other sessions at once — use it if you think someone else got in.
Extra protections
- Allowed IP address: restrict sign-in to an IP address or range. Only use a static IP — if yours changes, you'll lock yourself out.
- Strong password: Zoho requires at least 8 characters and blocks passwords containing your name or email address, or found in known breaches.
For administrators: require MFA for everyone
In the Zoho Mail Admin Console, go to Security and Compliance › Security › TFA, turn it on and select Enable TFA for your entire organization. Every user then chooses a method at their next sign-in.
Locked out? See resetting your Zoho Mail password.
How this guide was checked · October 2026
Verified against 4 official sources
Every step, setting and limit in this guide was checked against the provider’s own documentation on zoho.com and help.zoho.com. Anything we couldn’t confirm was left out.
Questions
Frequently asked questions
How do I turn on two-factor authentication in Zoho Mail?
Sign in at accounts.zoho.com, open Multi-Factor Authentication and set up OneAuth, an authenticator app, SMS codes or a YubiKey.
Where do I create a Zoho app password?
At accounts.zoho.com under Security › App passwords › Generate New Password. Copy it immediately — it's shown only once.
Why does Outlook reject my Zoho password after enabling MFA?
Email apps can't use your normal password once multi-factor authentication is on. Create an app password and use it instead.
What if I lose my phone with Zoho OneAuth?
Sign in with one of the recovery codes Zoho gave you when you set up multi-factor authentication, then set up your new phone.
Related guides
Keep reading
Zoho Mail Troubleshooting
Zoho Mail Not Working? Fixes for Sending, Receiving and Email Apps
Zoho Mail not receiving or sending? Check MX records, domain verification and storage, find missing messages, fix website form mail, and connect email apps over IMAP.
3 min read
Zoho Mail Password Reset
How to Reset Your Zoho Mail Password
Reset a forgotten Zoho Mail password at accounts.zoho.com/password with your recovery email, mobile, OneAuth or domain — and what to do if you can't verify or your account belongs to an organisation.
3 min read
Zoho Mail Login
How to Sign In to Zoho Mail
Sign in to Zoho Mail at mail.zoho.com with your email address or mobile number — plus multi-factor prompts, organisation accounts, regional data centres and fixes for common sign-in errors.
3 min read
Zoho Mail Sign Up
How to Create a Zoho Mail Account (Free)
Create a free personal Zoho Mail address or a free business account on your own domain — the steps, what the Forever Free plan includes, and its limits.
3 min read
Zoho Mail Settings
Zoho Mail Server Settings: IMAP, SMTP and POP3
Zoho Mail IMAP, SMTP and POP3 settings, authentication requirements and provider-specific connection fixes in one verified guide.
3 min read
Yandex Mail Security
Yandex Mail Security: Yandex Key, App Passwords and Sessions
Protect your Yandex Mail with two-factor authentication, app passwords for email programs, a recovery phone and the log-out-everywhere switch.
3 min read