Photo: Inbox.eu
Passwords come with familiar problems: they get forgotten, reused across services, and exposed in data breaches. That is why the Inbox.eu Business admin panel now offers one-time code login — a passwordless way to sign in. What passwordless login is, which types of one-time codes exist, and what this approach changes in practice – read on below.
What is passwordless login?
Passwordless login means confirming your identity without typing a static password. Instead of something you have to remember, you use something you receive at the moment of signing in – for example a one-time passcode (OTP): a short code that works once and expires within minutes.
The main types of one-time passcodes
One-time codes come in several forms, and you have likely met most of them:
- Email OTP – the code is sent to your email address. This is the method the Business admin panel uses.
- SMS OTP – the code arrives by text message. Convenient, but generally considered the weakest option, as phone numbers can be hijacked through SIM swapping.
- Authenticator apps (TOTP) – an app such as Google Authenticator generates time-based codes on your device, even offline.
- Magic links – instead of a code, you receive a sign-in link and click it.
- Hardware tokens – a physical device generates or holds the code; common in high-security environments.
Each balances convenience and security differently. For an admin panel that manages email, an email OTP is a natural fit: the inbox you already control becomes the key.
How it works in the Business admin panel
When you open the Inbox.eu Business Admin panel sign-in page, you can:
- Continue with GitHub, Google, or Facebook – sign in through an account you already have.
- Continue with email – enter your address, and we will send a six-digit, single-use code to your inbox.
New users are then guided to setup to add a domain and create mailboxes; returning users land directly in the admin panel.
What this approach changes in practice
- There is no stored password to steal. Credential theft relies on passwords that can be leaked, guessed, or reused across services. A one-time code removes that target: leaked password databases contain nothing that opens your admin panel.
- A code has a short life. A stolen password can be used indefinitely; an intercepted code expires within minutes and works only once.
- No reset flows. Forgotten passwords and reset emails disappear from your routine — every sign-in works the same way.
- Signing in from a new device is straightforward. There is nothing to retrieve from a password manager or type from memory; you only need access to your inbox.
One honest note: because your inbox becomes the key, the security of that email account matters more than ever. Enabling two-factor authentication on it is a good habit regardless of how you log in.
Setting up SSO for your team
One-time code login covers your access to the admin panel itself. If you manage mailboxes for a team, the admin panel also lets you configure Single Sign-On (SSO) via SAML or LDAP, so your mailbox users sign in through your organisation’s identity provider, for example – Keycloak or other similar solution by your Organisation’s IT departments choice. In short: code login is for the administrator, SSO is for your users.
The classic way remains available
Not everyone wants to change how they log in, and the choice stays with you. Your password is not going anywhere: select “Use legacy password instead” on the sign-in screen and continue exactly as before. One-time code login is an additional option, not a replacement.
Try it yourself
One-time code login is available now for Business admin accounts. The next time you sign in, try it – no password required. Manage your business email from one dashboard →
If you have questions about signing in or the admin panel, contact our support team.
