Find the message you see. Each entry says what it means and what to do.
"Invalid email or password."
The reply also says how many tries are left. The email is not case-sensitive, the password is. After five failed tries within 15 minutes the sign-in locks for 15 minutes. Locked sign-ins read Too many failed login attempts. Try again in N minutes. Wait it out.
"This account has been disabled."
The owner account was switched off. Whoever runs the server has to switch it back on in the database.
The two-factor code is refused
Codes last 30 seconds, so the clock on your phone must be right. Turn on automatic time in its settings. After six wrong codes that sign-in attempt is closed. Go back and enter your password again to start a new one. If the app on your phone keeps failing, use one of your ten recovery codes, which look like abcd-efgh. Each works once.
I lost my two-factor device and my recovery codes
You need to switch off two-factor in the database. This is a last resort, and it needs access to the server. Replace the email with yours.
Server:
sudo -u postgres psql inbox -c "UPDATE users SET totp_enabled = 0, totp_secret = NULL WHERE email = '[email protected]';"Docker:
docker compose exec db psql -U inbox inbox -c "UPDATE users SET totp_enabled = 0, totp_secret = NULL WHERE email = '[email protected]';"Sign in with your password, then turn two-factor on again under Settings → Security and save the new recovery codes. If you also registered a passkey, it keeps working.
I forgot my password
imbox has no email reset, because it has nothing to send one with before a mailbox is connected. If you are still signed in on another device, change it under Settings → Security. If not, set a new one from the server.
Make the hash on any machine with Node, using your new password in place of NEW_PASSWORD:
node -e '
const c = require("crypto"), salt = c.randomBytes(16);
const h = c.pbkdf2Sync(process.argv[1], salt, 100000, 32, "sha256");
console.log(`pbkdf2$100000$${salt.toString("base64")}$${h.toString("base64")}`);
' 'NEW_PASSWORD'Then store it. Put the whole output in place of HASH, and keep the single quotes:
sudo -u postgres psql inbox -c "UPDATE users SET password_hash = 'HASH' WHERE email = '[email protected]';"Sign-up is locked and I need a new owner
/signup works once. After the first account exists it is closed for good. imbox is single-owner by design. To start over, create a new database, or ask for the owner's password to be reset as above.
I keep getting signed out
A session lasts 30 days. If you are signed out sooner, check that your address uses https and matches APP_URL, since the session cookie is only sent over a secure connection. Also check that you did not change SESSION_SECRET. See the secret changed.