Password, Recovery and Login History
Changing your password, making sure you can recover it, and seeing who has logged in.
Changing Your Password
Open Settings → Password, enter the current password and the new one twice, and save. The new password takes effect immediately for the webmail. Mail programs connected with App Passwords are unaffected, which is one of the reasons to use them.
The page states the one hard rule, a minimum length of eight characters. Treat that as a floor: a long passphrase or a password-manager string is far better. Make it unique to CodaMail.
Password Recovery
CodaMail cannot look up or reset your password for you by email alone, because nothing about you is on file unless you put it there. Self-service recovery works only if you set it up in advance under Settings → Password Recovery:
- Security Question and Security Answer: choose a question only you can answer, and an answer that is not guessable from your public life. The answer is compared case-insensitively.
- Recovery Email: an address outside CodaMail that you control, where the reset link is sent.
When you forget your password, go to the password recovery page and enter your account name. An email with your security question and a link goes to the recovery address. The link is valid for 15 minutes. Open it, answer the question, and set a new password. Wrong answers are rate limited.
The stored question, answer and recovery address are encrypted on the server. Clear removes them. Review them whenever you change your other email address: a recovery address you no longer control is a way into your account for whoever controls it now.
If recovery is not set up, a forgotten password means a locked-out account. Set it up today.
Last Login
Settings → Last login lists the last ten logins over the past five days, with date and time, the IP address (partly masked), and the browser or program used. No location is looked up, since that would mean sending your address to an outside service. If you see a session you did not make, change your password, delete all App Passwords, and consider turning on a second factor.
The same information can be shown briefly after each login: turn on Show last session information under Preferences → User Interface. The login data is kept for five days only, for security and abuse handling, and then discarded.