Enabling TOTP two-factor authentication

Time-based one-time passwords (TOTP, defined in RFC 6238) add a second factor to your webmail login. Your authenticator app and the server both derive a six-digit code from a shared secret and the current time, and the code changes every 30 seconds. A stolen password alone is not enough to sign in. TOTP is one of two second factors ITProMail supports, alongside FIDO2 security keys.

What you need

Any app that implements standard TOTP will work, including common authenticator apps on phones and password managers that generate one-time codes. Install the app on a device you control and keep the device clock set to automatic. A code is only valid while the device and the server agree on the time.

Enable TOTP

1. Sign in to the webmail at https://itpromail.com/login/.
2. Open Account, then Security.
3. Find the two-factor section and choose the option to set up TOTP.
4. Scan the QR code with your authenticator app. If you cannot scan it, enter the setup key shown on the page into the app manually, choosing time-based codes.
5. Enter the six-digit code the app displays to confirm the setup. The code must be current when you submit it.
6. Save the backup codes the page shows before you leave it.

Once TOTP is active, the webmail asks for a code after your password on each new sign-in.

Backup codes

Backup codes are the way back in if you lose the authenticator device. Store them offline, for example in a printed copy kept in a secure place, or in a password manager entry that is separate from the one holding your password. Do not store them in the same file as your password, and do not keep them in a screenshot or a notes app that syncs to devices you do not control.

Treat each backup code as single-use. Once you have used one, it should no longer work. If the page offers to generate a new set, the old codes should be treated as invalid after you do so, so store the new set and discard the old one.

Mail clients are not affected

TOTP protects the webmail login. Mail clients such as Thunderbird, Apple Mail or aerc do not prompt for a code, and they do not use your account password. They use app passwords created under Account, then Security. Enabling TOTP does not change how your clients connect. Revoke an app password if a device is lost, and enable TOTP to protect the webmail itself.

Testing the setup

Before you rely on TOTP, sign out and sign in again. Confirm that the code prompt appears and that the current code from your app is accepted. Check that the backup codes are stored where you can reach them without the authenticator device.

Losing the device

If you lose the phone or the app, use a backup code at the sign-in prompt, then reconfigure TOTP from Account, then Security. If you have no backup codes and no other second factor, follow the process in account recovery. Registering a hardware key as well avoids being locked out by a single lost device; see registering FIDO2 security keys.

For a broader checklist of steps to harden the account, see the security checklist.