Photo: Inbox.eu

Passwords come with familiar problems: they get forgotten, reused across services, and exposed in data breaches. That is why the Inbox.eu Business admin panel now offers one-time code login — a passwordless way to sign in. What passwordless login is, which types of one-time codes exist, and what this approach changes in practice – read on below.

What is passwordless login?

Passwordless login means confirming your identity without typing a static password. Instead of something you have to remember, you use something you receive at the moment of signing in – for example a one-time passcode (OTP): a short code that works once and expires within minutes.

The main types of one-time passcodes

One-time codes come in several forms, and you have likely met most of them:

• Email OTP – the code is sent to your email address. This is the method the Business admin panel uses.
• SMS OTP – the code arrives by text message. Convenient, but generally considered the weakest option, as phone numbers can be hijacked through SIM swapping.
• Authenticator apps (TOTP) – an app such as Google Authenticator generates time-based codes on your device, even offline.
• Magic links – instead of a code, you receive a sign-in link and click it.
• Hardware tokens – a physical device generates or holds the code; common in high-security environments.

Each balances convenience and security differently. For an admin panel that manages email, an email OTP is a natural fit: the inbox you already control becomes the key.

How it works in the Business admin panel

When you open the Inbox.eu Business Admin panel sign-in page, you can:

• Continue with GitHub, Google, or Facebook – sign in through an account you already have.
• Continue with email – enter your address, and we will send a six-digit, single-use code to your inbox.

New users are then guided to setup to add a domain and create mailboxes; returning users land directly in the admin panel.

What this approach changes in practice

1. There is no stored password to steal. Credential theft relies on passwords that can be leaked, guessed, or reused across services. A one-time code removes that target: leaked password databases contain nothing that opens your admin panel.
2. A code has a short life. A stolen password can be used indefinitely; an intercepted code expires within minutes and works only once.
3. No reset flows. Forgotten passwords and reset emails disappear from your routine — every sign-in works the same way.
4. Signing in from a new device is straightforward. There is nothing to retrieve from a password manager or type from memory; you only need access to your inbox.

One honest note: because your inbox becomes the key, the security of that email account matters more than ever. Enabling two-factor authentication on it is a good habit regardless of how you log in.

Setting up SSO for your team

One-time code login covers your access to the admin panel itself. If you manage mailboxes for a team, the admin panel also lets you configure Single Sign-On (SSO) via SAML or LDAP, so your mailbox users sign in through your organisation’s identity provider, for example – Keycloak or other similar solution by your Organisation’s IT departments choice. In short: code login is for the administrator, SSO is for your users.

The classic way remains available

Not everyone wants to change how they log in, and the choice stays with you. Your password is not going anywhere: select “Use legacy password instead” on the sign-in screen and continue exactly as before. One-time code login is an additional option, not a replacement.

Try it yourself

One-time code login is available now for Business admin accounts. The next time you sign in, try it – no password required. Manage your business email from one dashboard →

If you have questions about signing in or the admin panel, contact our support team.

User data are leaked all the time on the internet, with social networks, dating sites, gaming services and other websites that store personal data of their users being under constant threat.

Attackers are primarily interested in top websites with large numbers of users. Successful break-ins result in passwords becoming public, expanding the lists of known passwords.

Finding these lists is very easy. They are publicly available to anyone on the internet. There are plenty of sources if you look this topic up in a search engine. Anybody who intends to break in to someone else’s mailbox will definitely use these lists.

Inbox.lv uses a large number of additional methods to protect its users, which includes sending various notifications to them.

If you receive a warning reminding you to change the password in your mailbox, please do not ignore it!

An insecure password notification warns you that the combination of characters you currently use as a password may be one of the first in the list of those tried by people attempting a break-in, which makes your mailbox vulnerable and easily accessible to unauthorised individuals.

If the inbox.lv team tells you that you must change your password, please do not leave this security problem unattended, no matter how much you like your current password or find it convenient. Changing your password takes a couple of minutes; dealing with a break-in will take a lot of time, work and grief.

We also recommend you to try two-factor authentication, whereby accessing your mailbox requires entering not only the password, but also a number shown on your mobile phone. This function makes logging in to your mailbox more secure when you use public-access devices. Read more >>

For better protection of your account:

2-factor authentication: unique access to your mailbox. When you enable this option, not only a password, but also a code from your personal phone will be required to sign in to your email account. Read more

Self-service password reset in the case of its loss:

Make sure your profile contains your mobile phone number or an alternative email address: this will help you to independently, quickly recover access to your mailbox at any time. Go to profile right now.

Backup features:

1. When receiving important files in emails, keep a copy of them on Inbox.lv Files without time limits and completely free of charge. In the case of deleting an email, the files will always remain available to download and view. Go to Inbox.lv Files

2. Remember, emails accidentally deleted from the trash can be recovered within 7 days after their deletion. How can do it?

For reducing junk mail in the mailbox:
1. If you have subscribed somewhere so that your mailbox has become filled with spam, enable the “Increased protection against spam” setting. Most of such emails will immediately go to the “Spam” folder, which will facilitate work with incoming mail. Turn ON now?

2. Help us, by reporting spam emails that came into your inbox: click on the “Spam” button at the top of the email. After clicking, the received information is processed by the inbox.lv internal systems and the marked spam emails begin to be deleted immediately, without getting to the mailboxes of the users.

Working with emails on your phone:

1. The best solution is the Inbox.lv mobile application. Free, and with many features, it is available for Android and iOS phones. Can quickly download from the Play Market, App Store or Samsung Story.

2. Pop3/Imap protocols are also available for all inbox.lv users to make working with mail via mail clients possible for them. Settings for email client software


Inbox.lv technical support: free phone number 82000 or support@inbox.lv.

On December 2017 massive passwords database was published. There is total of 1.4 billion of emails with passwords. Part of services where passwords was stolen is huge: Last.FM, Bitcoin, Pastebin, LinkedIn, MySpace, Netflix, YouPorn, Zoosk, Badoo, RedBox, games like Minecraft and Runescape, Anti Public, Exploit.in ….

We have purchased that list of all passwords and filtered our users. We force every affected user to change it passwords. It’s only matter of time when somebody else will start using your email account if password will not be changed.

How to protect yourself in the future:

1. Don’t use the same password for different services.
2. Use password manager software to remember all passwords and make it secure.
3. Always use two pass authorizations on every place where it exists
4. Don’t use easy guessing passwords

The Inbox.lv team encourages increased awareness of this event, as users who use the same password to log in to Inbox.lv email accounts and other networks are also at risk.

Please remember that your only data protection is a password which must consist of at least 8 characters, including numbers and capital letters. Your password must be sufficiently complicated, so we encourage users not to use their name, surname, names of pets or other identifying information that is publicly available.

If your password is too simple or has not been renewed for an extended period, we recommend changing it in your account settings. Please remember to also check and renew all information needed to gain access to your account, for example, secret question and answer, mobile phone number and alternative email address. We must emphasise that any Inbox.lv user has the opportunity to apply an extra level of security through two-factor authorisation, which averts hacking and break-in attempts.

If you have any questions, write to support@inbox.lv or call for free at 82 000.

   Nowadays, email is one of those places where everyone tends to keep a variety of personal and professional information and this is the reason why Inbox.lv created 4 new security notifications which will receive all of our e-mail server users.

     The main goal of these notifications is to inform you about variety unusual or suspicious activities in your mailbox. Everyone need to remember that third-person access to your mailbox may result not only in some complications, but also in financial losses!

    To help you keep track of your account security, Inbox will send an e-mail message each time when:

• You or someone else would like to reset password to inbox.lv user account;
• System will detect an unusual sign-in activity;
• When you set up two-step verification;
• When you remove two-step verification;