A password manager and a mailbox are closely linked. The manager holds passwords for every account, and the mailbox receives the resets for most of them. Used well, the two reinforce each other. Used carelessly, they create one point of failure. This article covers how to set them up together.
Protect the vault first
The vault's master password is the key to everything stored in it, including the mailbox password and app passwords. Make it long, unique and never reused. Do not use your mailbox password as the vault password, and do not store the vault password in the mailbox. Enable a second factor for the manager account if it offers one, and keep an offline copy of the recovery kit or emergency access information.
Keep mailbox credentials out of the wrong places
- Store the mailbox password in the vault, and use it only for the webmail login and the account settings.
- Use app passwords for mail clients. Create one per device or client in the account security settings, and store it in the vault with a label that names the client. Revoke it if the device is lost. See app passwords.
- Do not paste credentials into notes, chat or shared documents. A password manager can generate and fill them, so there is rarely a reason to type them out.
One address per service
A single address reused across hundreds of services makes it hard to tell where a leak came from, and it makes every breach a bigger problem, because the same address is used everywhere. Giving each service a distinct address solves both issues. Two common ways to do it:
- Aliases. Create a named alias such as
shop@example.comthat delivers to your mailbox. You can disable an alias that starts receiving spam without affecting anything else. The aliases guide explains the setup. The number of aliases depends on your plan. - Plus-addressing. Use
you+shop@example.comand a Sieve rule to file it. This needs no setup, but the tag is visible to anyone who sees the address, and some services strip or reject plus signs. The subaddressing guide covers the details.
Store the address alongside each login in the vault, so the address you used is always recorded. That record is what makes an alias useful later.
Reading a leak with per-service addresses
Suppose a message arrives at an alias you only gave to one retailer, and that alias starts receiving phishing. You know which service the leak likely came from, and you can disable that alias without touching your other accounts. Your vault should show which password and which account used the address, so the next step, changing the password and checking for reuse, is straightforward.
Autofill is a useful signal
A password manager fills credentials only for the domain it has stored. If you visit a page that looks like your bank but the manager does not offer to fill, pause before typing anything. The missing fill is often the first sign of a lookalike site. This pairs well with the checks in lookalike domains and homoglyphs.
Recovery codes and the mailbox
Many services send recovery codes or reset links to the mailbox. If the mailbox is protected by a password manager and an app or hardware second factor, the chain is reasonably strong. Keep the recovery codes for the vault and for the mailbox offline, in a location that does not depend on the same device or account. Review which services use the mailbox for recovery, and remove any you no longer use.
A simple setup
- Choose a long master password for the manager and enable a second factor for the manager account.
- Store the mailbox password in the vault and enable a second factor on the mailbox.
- Create an app password for each mail client and store each one in the vault.
- Create an alias or plus-address for each new service, and save the address with the login.
- Review the sessions and app passwords list every few months, and revoke anything unused.
What this does not do
A password manager does not stop phishing that tricks you into approving a login, and an alias does not protect a password that is reused. These measures reduce exposure and make problems easier to isolate. They are not a guarantee. The security checklist lists the account settings to review, and the TOTP and FIDO2 guides explain the second factors that work well with a vault.