When you subscribe, your portal password and your mailbox password are the same. That is a convenience for day one. It is not where we want you to live.
If you change your password in webmail, the change applies only to IMAP. That is intentional. We prefer subscribers keep two different passwords: one for IMAP, one for the account portal. It is not required. It is highly recommended.
How recovery works
- Forgot the portal password? Reset it with your webmail password.
- Forgot IMAP / webmail? Open the portal, go to the account page, use the password tab. That is the one place that manages both.
- Forgot both? Reclaim through a verified phone number or a verified alternate email.
- If all of that fails and the subscription is current, open a support case.
Other two-factor options are coming. You can run a pure IMAP client and never open webmail — with the caveat that some features exist only in the webmail portal. The subscription portal is deliberately limited so that split stays clean. Business subscribers are the exception: a few duplicated features live there, adapted for administration.
JMAP is also supported, and we are moving in that direction with the new webmail portal development. If you run a JMAP client and encounter any issues, let us know.
What we monitor
SIEM is not a checkbox we bought and forgot. We run monitoring, detection, and alerting for systems and security events, and we will keep improving it. Roundcube webmail currently uses a Cloudflare Turnstile humanity check; as noted, we are building our own webmail, which will not need it.