Sign-in and security guide

This guide covers the sign-in page, two-step sign-in, passkeys and encrypted mail in server release 0.115 and the Android app 0.4.0.

1. Sign in on the web

1. Go to mail.endpapermail.com.
2. Under Welcome to your mail, type your full address in Email address, for example ana@endpapermail.com.
3. Type your password in Password. Select Show password to check what you typed.
4. Select Sign in →. Your browser runs password-free sign-in (OPAQUE). Your password stays in the browser.
5. If you turned on two-step sign-in, a field named Code from your authenticator app appears. Type the 6-digit code and select Sign in → again. Or select Use a passkey instead.
6. The Inbox opens.

The page also offers Language, Forgot password? (see section 4) and Use Gmail, Yahoo, iCloud or another provider (see section 3).

2. Sign in on Android

The app opens on a screen titled Your mail, quietly yours. and offers two modes.

EndPaper server mode

1. Enter your EndPaper address and password.
2. If the server address field shows, type mail.endpapermail.com. The app accepts only an https:// server root.
3. Type the 6-digit code when the field Code from your authenticator app appears.
4. Turn on Stay signed in on this phone if you want new-mail notifications. The app then keeps your password sealed with the phone's hardware key and signs in again when the 30-minute server session ends.

Any email account mode

The phone talks to your provider over IMAP and SMTP with verified TLS. No EndPaper server sits in between. You add up to 5 mailboxes.

3. Use Gmail, iCloud or another provider

Pick your provider from the list. EndPaper fills in the server names. Most providers need an app password instead of your normal password.

On the web, features that need EndPaper's own mail server stay off for other providers: server drafts, scheduled send, snooze, rules, contacts, templates and signatures.

4. Password and recovery

Set a recovery email first

1. Open Settings › Password & recovery and select Show recovery settings.
2. Type an address you already use in Recovery email address and select Send verification code.
3. Type the 4-digit code from that inbox and select Verify recovery email. A ✓ Verified mark appears.

Change your password

1. In the same section, type your Current mailbox password.
2. Type the new password twice. Use 16 to 128 characters with uppercase, lowercase and digits, and no spaces.
3. Use Password generator › Generate password for a strong one. Save it in your password manager before you apply it.
4. Select Change password. Your other web sessions end. Update the password in any other mail app you use.

Forgot your password

1. On the sign-in page select Forgot password?.
2. Type your EndPaper address. A 4-digit code goes to your verified recovery email.
3. Type the code and your new password twice, then select Reset password. The code expires after 10 minutes.

Without a verified recovery email, contact support@endpapermail.com. EndPaper never sends a reset to a new, unverified address.

5. Two-step sign-in

1. Install an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator, 1Password or Aegis.
2. In EndPaper, open Settings › Two-step sign-in and select Set up two-step sign-in.
3. In the authenticator app, add an account and choose to enter a setup key. Type the key EndPaper shows. On the same phone, use the link to open the authenticator app.
4. Type the 6-digit code the app shows into 6-digit code and select Turn on.
5. Sign out and sign in again to test the code.

Mail apps such as Outlook still use your mailbox password. The code protects web and EndPaper app sign-in. If you lose your phone, ask support to remove the code for your address.

6. Passkeys

1. Turn on two-step sign-in first. Your authenticator code stays as the backup.
2. Open Settings › Passkeys, type a name such as Pixel 9 in Name for the new passkey and select Add a passkey.
3. Confirm with your fingerprint, face, screen lock or security key.
4. Next time, select Use a passkey instead on the sign-in page.

A passkey works only on the real EndPaper site, so a fake sign-in page cannot use it.

7. Set up encrypted mail

1. Open Encrypted mail in the web menu or the Android drawer.
2. Choose a passphrase of 12 characters or more that you use nowhere else. Type it twice.
3. Tick Keep a copy of the recovery file on EndPaper if you want restore with words only. The copy opens only with your 24 words, which EndPaper never sees.
4. Start setup. The status reads Creating post-quantum keys. This takes a few seconds.
5. Write the 24 words on paper. Select Save recovery file and store the file somewhere other than this device.
6. Tick I wrote down the words (or I wrote down the words and saved the file) and select Done.
7. The status reads Setup finished. Your keys are now published.

Your keys stay unlocked until you lock them, leave the screen or switch apps. Messages open on your device only, in plain text view.

8. Restore keys on a new device

1. Open Encrypted mail and select I already set this up on another device.
2. Type your 24 words. With a copy on EndPaper, that copy gets used. Otherwise select Choose recovery file.
3. Choose a new passphrase for this device and type it twice.
4. The status reads Keys restored. Unlock with your new passphrase.

Forgot only the passphrase? Select Forgot the passphrase? Restore with recovery words on the unlock screen.

9. Check the key log

Each unlock checks the signed key log. A failed check shows Key log check failed. Do not trust keys from the server until support explains it.

1. On your first device, open Encrypted mail › Compare the key log with another device and note the code.
2. On the second device, open the same section and type that code in Code from the other device.
3. A match shows The codes match. Both devices saw the same key log.

10. Images and attachments

• Messages open with remote images blocked. Select Load remote images in formatted view to allow them for one message. They load through the EndPaper image proxy.
• Attachments get a virus scan before download. A file with a detected threat, or a failed scan, does not download.
• Downloads have a 10 MiB limit. Preview covers images up to 5 MiB and plain text up to 256 KiB.
• Sending allows up to 5 attachments, 10 MiB combined.

11. Connect Outlook, Apple Mail or Thunderbird

1. Open Settings › Connect an email app and select Show my setup details.
2. Select Apple Mail profile for iPhone, iPad or Mac, then approve the profile on your device. The profile is unsigned, so review it before you approve.
3. For Outlook, use manual IMAP setup with the details shown. For Thunderbird, enter the details shown.
4. Select Check connection to test the server side.

The setup files never contain your password or an access token.

12. Sign-in messages explained

Still stuck? Write to support@endpapermail.com.