Secure your email account: Guard the master key to your digital life

Why your email inbox is so valuable

Almost every service sends password reset links via email. If someone controls your inbox, they can slowly log in to your other accounts — shops, social networks, and sometimes even payment services. That’s why your email account deserves the best protection of all.

Step 1: A unique, long password

You must never use your inbox password anywhere else. Use at least 16 characters or a sentence made up of multiple random words. Our password generator creates one for you and checks if the password has appeared in any data breaches.

Step 2: Enable two-factor authentication

With a second factor — an app with one-time codes or a security key — a stolen password alone is no longer enough. SMS codes are better than nothing, but apps and keys are safer. Keep your backup codes in a safe place, such as printed out and stored at home.

Step 3: Check your recovery options

• Is your backup phone number still current?
• Do you still own and use the backup email address?
• Remove any old numbers and addresses you can no longer access.

Attackers often use outdated recovery details to take over accounts.

Step 4: Find hidden backdoors

After a breach, attackers often set up inconspicuous rules. Check these settings in your mailbox:

• **Forwards:** Are emails being automatically sent to an unfamiliar address?
• **Filters and rules:** Are certain emails, for example from your bank, being automatically deleted or moved?
• **Connected apps and devices:** Do you recognize all of them that have access?
• **Recent logins:** Are there accesses from locations or devices you don’t recognize?

Step 5: Spot phishing

Most inbox takeovers begin with a fake login page. Only enter your password when you have navigated to the page yourself — never via a link in a message. Our Mail Check shows you whether a sender is spoofed.

On the go

If you check your emails over public Wi-Fi, a VPN protects your connection to our servers from eavesdroppers on the same network. This doesn’t affect your email provider’s encryption — the VPN is an additional layer of security.

If your inbox has been hacked

• Change your password immediately — from a device you trust.
• Log out of all other sessions and enable two-factor authentication.
• Delete any unknown forwards and rules.
• Then, change the passwords for your other most critical accounts.
• Warn your contacts if suspicious messages have been sent from your address.

Our First-Aid page guides you through it step by step.