Account security

Two-factor authentication for webmail.

Two-factor authentication adds a second layer of security — a one-time code — on top of your password.

  • Blocks access even when a password is guessed, reused, or leaked elsewhere.
  • Stops most automated and phishing-based sign-in attempts on their own.
  • Adds one extra step — entering a code — every time you sign in.

Setup

Turn on two-factor authentication

Two-factor authentication and app passwords are both managed from the same settings panel in Bulwark.

Enable two-factor authentication

Do this in Bulwark — RoundCube has no equivalent setting.

  1. Log in to Bulwark at mail.pwhosts.com.
  2. Click the gear icon to open Settings.
  3. Go to Privacy and security > Security.
  4. Turn on two-factor authentication and follow the prompts to finish setup.

Create an app password

Use this wherever a normal 2FA prompt isn't possible.

  1. Log in to Bulwark at mail.pwhosts.com.
  2. Click the gear icon to open Settings.
  3. Go to Privacy and security > Security.
  4. Open App passwords and create a new one.
  5. Use the generated password in place of your regular password.

Common questions

App passwords and RoundCube

Answers to what comes up most once two-factor authentication is turned on.

Why doesn't RoundCube support two-factor authentication?

RoundCube's login form only accepts a username and password — there's no field for a one-time code. Once two-factor authentication is turned on for your account, RoundCube can no longer sign in with your normal password, so it needs an app password instead.

What is an app password?

An app password is a separate, generated password for signing in to a specific app or mail client. It's meant to be used instead of your account password anywhere a two-factor prompt isn't supported, without turning off two-factor authentication on the account itself.

Where do I create an app password?

In Bulwark at mail.pwhosts.com, open the gear icon for Settings, go to Privacy and security > Security, then App passwords.

Which apps need an app password?

RoundCube, and any desktop or mobile mail app connected over IMAP or SMTP that doesn't support a two-factor prompt during sign-in. If an app rejects your normal password after 2FA is turned on, use an app password there instead.