Securing webmail: two-factor sign-in and encryption

Webmail is only as safe as the one password that opens it and the browser it runs in. Two additions close most of the gap: a second factor at sign-in, so a stolen password is not enough on its own, and end-to-end encryption with Mailvelope, so the messages that matter stay unreadable on every server they pass through. This article explains both, what each one does not cover, and where Noiz provides them.

What webmail protects, and what it leaves open

Webmail is your mailbox in a browser tab: you sign in at an address such as webmail.yourdomain.com and read your mail on the mail server itself. Nothing is stored on the computer you use, which is why it is convenient on the road.

The same design sets its limits. Anyone who has your mailbox password can sign in from anywhere in the world. Your mail sits readable on the server, as ordinary email does. And the browser holds the signed-in session, so whatever can read the browser can read the session. Two-factor sign-in deals with the first problem and encryption with the second. Good habits deal with the third.

Two-factor sign-in for webmail

Two-factor sign-in asks for something you have, such as a code from your phone or a security key, on top of the password. A password bought from a data leak then gets an attacker nowhere.

Roundcube

Roundcube, the open-source webmail on many hosting platforms, Noiz shared hosting included, has no two-factor sign-in of its own, in version 1.6 or 1.7. A server operator can add it with a plugin, such as the open-source twofactor_gauthenticator, or hand the sign-in to a separate identity service that asks for a second factor.

A plugin protects the webmail login page only. Mail apps such as Thunderbird or the mail app on a phone connect to the server directly over IMAP and SMTP, and on most setups they still need just the mailbox password. So a second factor on webmail alone leaves the side door open.

Mailcow

Mailcow, the open-source mail server Noiz runs as Private Email, builds two-factor sign-in in. Every mailbox user can turn it on in their own settings. Webmail goes through the same sign-in, so the second factor protects webmail as well as the account page.

Choosing a second factor

Not every second factor is equally strong. The US Cybersecurity and Infrastructure Security Agency (CISA) calls phishing-resistant methods, such as FIDO2 security keys, the gold standard, and SMS codes a last resort. The UK National Cyber Security Centre (NCSC) warns that any method based on typing in a code can be phished by a convincing fake login page.

In practice:

If you keep your codes in a password manager such as KeePassXC, keep them in a separate database from your passwords. KeePassXC's own guide warns that storing both together removes the advantage of a second factor.

Encrypting messages in webmail with Mailvelope

Two-factor sign-in protects the door. It does nothing for the messages once they are on a server, or for a copy sitting in the recipient's mailbox. For that you need end-to-end encryption, and in webmail the established tool is Mailvelope.

Mailvelope is a free, open-source browser extension for Chrome, Firefox and Edge. It uses OpenPGP, the same standard as Thunderbird's built-in encryption, so the two can write to each other. It has been audited independently several times, including a review for Germany's Federal Office for Information Security (BSI) in 2019 and an audit in February 2025.

How it works:

• Your keys stay on your computer, encrypted inside the extension. Every use asks for your passphrase, and nobody can recover that passphrase if you forget it, so back the key up.
• You write inside a Mailvelope window that sits in the webmail page. The message is encrypted before it leaves the browser, so the mail server only ever stores scrambled text.
• Roundcube has built-in support. Once you authorise your webmail address in the extension, Roundcube shows the encryption options.

Mailvelope has limits worth knowing before you rely on it. It does not encrypt the subject line or the addresses. It does not run in phone browsers. And Mailvelope itself says it is only as secure as the browser it runs in: a computer infected with malware can still read what you read. On a phone, an OpenPGP mail app such as Thunderbird for Android does the same job.

Our help article How to encrypt webmail with Mailvelope and OpenPGP walks through the set-up on Noiz webmail, and Why and how to encrypt your email with OpenPGP explains the ideas behind it.

Habits that keep a webmail session safe

A second factor and encryption still depend on the browser session being yours alone.

• Sign out when you finish. Closing the tab can leave the session alive, and browsers that restore tabs can bring it straight back. Signing out ends the session on the server.
• Do not use webmail on shared or public computers. The NCSC says never to save a password in the browser on a shared device. Someone else's computer may also be infected with malware you cannot see.
• Keep the browser and its extensions few and up to date. Webmail runs inside the browser, and so does every extension you install.
• Use a password for your mailbox that you use nowhere else. If another site leaks it, your mail stays shut.

Where Noiz fits

Webmail on every Noiz shared hosting plan is Roundcube, with Mailvelope support ready to use. Its sign-in is the mailbox password, so give each mailbox a strong password of its own and add Mailvelope for the messages that need it.

For an organisation that wants a second factor on its mailboxes, Noiz runs Private Email: Mailcow on a server for your organisation alone, with two-factor sign-in for users, and the server, updates and backups looked after by Noiz. Each deployment is quoted; the email hosting page compares it with the email included in hosting.

If your mail has become important enough to need a second lock, ask us for a Private Email quote.

Sources

• Mailcow documentation, two-factor authentication: https://docs.mailcow.email/manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/
• Roundcube changelog and releases: https://github.com/roundcube/roundcubemail/blob/master/CHANGELOG.md
• twofactor_gauthenticator plugin for Roundcube: https://github.com/alexandregz/twofactor_gauthenticator
• Mailvelope FAQ: https://www.mailvelope.com/en/faq
• Mailvelope help: https://www.mailvelope.com/en/help
• Mailvelope security audits: https://github.com/mailvelope/mailvelope/wiki/Security
• BSI audit of Mailvelope (2019): https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html
• OWASP Session Management Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html
• NCSC, password managers: https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/password-managers
• NCSC, passkeys are more secure than traditional ways to log in (23 April 2026): https://www.ncsc.gov.uk/blogs/passkeys-are-more-secure-than-traditional-ways-to-log-in
• CISA, Implementing phishing-resistant MFA (October 2022): https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf
• Aegis Authenticator: https://getaegis.app/
• 2FAS: https://2fas.com/
• Ente Auth: https://ente.com/auth/
• KeePassXC user guide: https://keepassxc.org/docs/KeePassXC_UserGuide

Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.