In short: we don't know your passwords. Only an encrypted form is stored, and checks are anonymous.
Customer account and email mailboxes
- No plain text: Neither your customer area password nor your mailbox passwords are stored in readable form. Only a so-called *hash* is stored – a kind of fingerprint that lets us check at login whether the password is correct. The password cannot be calculated back from it.
- Mailboxes: When you set a mailbox password in the customer area, it goes straight to the mail server. The mail server only keeps it encrypted; the customer portal doesn't store it at all.
- Our team doesn't know it either. That's why we can't tell you a password – if you've forgotten it, simply set a new one.
Check for data breaches
When you set a password, we check whether it appears in known data breaches – attackers try those passwords first. The check is anonymous: your password never leaves our server. Only a 5-character piece of a check value is sent to the checking service, and the password cannot be calculated back from it. Nothing is stored in the process.
If a password appears in a data breach, we reject it. Mailbox passwords also need at least 10 characters.
Old mailbox passwords
We can't check a password that was set before this check was introduced – precisely because we don't know it. That's why the mailbox shows "Please set the password once". Under Domains → your domain → Email → shield icon you can also see recent logins, failed attempts and the mail sent from your mailbox.
Tips
- Use a separate, long password for each mailbox – a password manager helps.
- Switch on two-factor login for the customer area (under "Security").
- We will never ask you for your password by email or phone.