Protect access to your team's email.
Your team's inbox. Each person's own login. An extra layer of protection with optional two-factor authentication for password sign-in, included on every plan.
Control how people access your inbox
An extra code at sign-in
Turn on two-factor authentication for password sign-in. Use an authenticator app such as Google Authenticator, Microsoft Authenticator or 1Password.
Backup codes for lost devices
Save single-use backup codes outside your mailbox. Use one with your password if you lose your phone. Regenerating codes invalidates the previous set.
Change phones without a gap
Your current authenticator works until you verify the new one. Changing it signs out other sessions and clears remembered devices; unused backup codes still work.
Shared inbox, individual access
Everyone opens shared mailboxes with their own account. Choose which members can access each mailbox; owners and admins can access every shared mailbox.
Review active sessions
Account settings lists your signed-in browsers and devices. Sign out individual sessions or the other sessions when you change your password.
Manage connected access
Review API keys and connected AI apps separately. Two-factor authentication protects password sign-in; it does not add a code to each API request or revoke existing integrations.
Set up an authenticator in Account settings
- Confirm your password and scan the QR code with your authenticator app.
- Enter a six-digit code to activate protection. Scanning alone does not turn it on.
- Save your backup codes somewhere outside your Work Inbox account.
Already have an account? Open your security settings.
Questions about email security and 2FA
Is two-factor authentication included in the free plan?
Yes. Optional authenticator-based 2FA is available for individual accounts on every plan, including free and self-hosted installations.
Can I protect a shared mailbox with 2FA?
Each person can enable 2FA on their own account for password sign-in. Shared mailboxes such as support@ use individual accounts and access permissions, so nobody needs to share a password or authenticator setup.
Does Work Inbox ask for a code when I sign in with Google?
No. Google sign-in uses Google's security settings. Enable two-step verification in your Google account separately. Work Inbox does not enforce Google's two-step verification policy.
What happens if I lose my authenticator?
Use an unused backup code after your password, then change your authenticator in Account settings. Resetting your password does not disable 2FA. Without an authenticator and backup codes, access recovery is not guaranteed.
Can an administrator require 2FA for the team?
Not yet. Each person currently chooses whether to enable 2FA. Organization-wide enforcement is not available.
Does 2FA make my account phishing-proof?
No. Authenticator codes add protection to password sign-in, but can still be stolen through phishing. Never share your password, authenticator key or backup codes, and check the site's address before signing in.
Read the setup and recovery guide, or learn how shared mailbox access works.
Bring your domain
Your team's mail on it this afternoon.