Sign-in security

To protect mailboxes on this service, sign-in is monitored for abuse. Most people never notice these checks. This page explains what you may see and why — without listing internal thresholds.

What we do at sign-in

• Failed sign-in attempts are tracked. After repeated failures you may be asked to complete a captcha (or reCAPTCHA when enabled).
• After you type your username, the real site can show your personal sign-in mark (a short phrase and optional tiny picture you chose under Options → Sign-in mark) before you enter your password. If that mark is missing or wrong, stop — you may be on a fake copy of this page. On slow or low-bandwidth Classic logins, only the phrase is shown. Always open webmail from a bookmark or by typing the real address; prefer a passkey when available.
• Continued failures from the same network address can temporarily block webmail sign-in from that address.
• A mailbox that receives many wrong passwords in a short time — including attempts from several places — can be temporarily locked to slow password guessing.
• If you enrolled a passkey, you can sign in with that passkey instead of typing your mailbox password.
• If two-factor authentication is on and Phone passkey sign-in is enough is checked, unlocking with Face ID or fingerprint on your phone (or Approve with phone) finishes login without an extra code. A computer-only Windows Hello or PIN passkey never skips that second step. Password sign-in still needs a second factor.
• If two-factor authentication is on and you chose to remember a browser, repeated wrong passwords for that mailbox temporarily ignore that memory — you must complete the second step again until things calm down or you finish 2FA successfully.
• Unusual device or location changes may require an extra captcha before you continue. Signing in from a computer or phone you already use is not treated as unusual.
• When your network address can be mapped to a city or region, a sign-in from a very different place may require an extra captcha.
• You can optionally allow webmail sign-in only from countries you choose (Options → Devices & sessions). Sign-in from other countries is refused for that mailbox.
• Very heavy traffic against the sign-in pages can trigger short protective limits for that visitor.
• When many failures happen across the service at once, captcha may be required more often for everyone until things calm down.

Why you might be blocked

Common causes include mistyped passwords, password managers retrying old credentials, shared Wi‑Fi or VPN addresses used by others, automated scanners probing the login page, or someone else trying to guess a password for your mailbox.

A temporary block is protective. It does not always mean your password was changed or that your account was deleted.

What to do

• Wait a short while and try again carefully with the correct password.
• If you see a captcha, complete it before submitting the form.
• Avoid rapid repeated tries; each failure can lengthen the delay.
• If you remain locked out and need access urgently, contact your administrator or support channel for this service.

What this page does not list

Exact attempt limits, timers, and technical controls are not published here. Sharing those details would help attackers tune automated guessing. The protections above are real; only the fine print stays internal.

After you sign in

A lock icon in the browser only covers the path from your device to this webmail site. Mail still travels again from webmail to IMAP (reading) and SMTP (sending). Signed-in users can open Options → Connection Security to see whether those hops are encrypted, which login method the mail server advertised, and which method this session used.

• The mailbox password stays in the webmail server session. It is not stored in a browser cookie.
• LOGIN or PLAIN over TLS is still secure: TLS encrypts the entire session, including the password. If the mail server offers SCRAM, webmail can use it so the password is not sent even inside that tunnel. You can turn that on or off on Connection Security.
• IMAP can use implicit TLS (port 993) or STARTTLS (port 143). SMTP can use STARTTLS (587) or implicit TLS (465). SASL PLAIN is available when the LOGIN command is disabled. LOGIN or PLAIN without TLS is the insecure case.
• Remote pictures in HTML mail stay off the network unless you allow them. SVG attachments are blocked for download unless you trust that message (Show remote images or an Unsafe Image Rule). Junk folders stay blocked.

Return to login