Two-Factor Authentication for Email: The Setup Guide That Stops Hackers

Why is your email account the one you have to protect first?

Make a list of the accounts that matter to you, your bank, your investments, your social profiles, the place you store photos, the service that pays your bills, and ask a simple question of each one: if you forgot the password, how would you get back in? For almost every one, the answer is the same. The service sends a reset link to your email. That single fact reorganizes everything you think you know about online security, because it means your email account is not just one account among many. It is the master key that opens all the others. Whoever controls your inbox can walk through the front door of nearly every account you own, one password reset at a time, and they will not even need to guess a single one of those other passwords.

This is why securing email is not the same priority as securing any other login, and why it deserves to be the first thing you lock down rather than the last. A criminal who breaks into your streaming account is a nuisance. A criminal who breaks into your email is an emergency, because from there they can request a password reset on your bank, intercept the link, change the password, lock you out, and drain the account, all while you are still wondering why your streaming queue looks strange. The inbox is the linchpin. Pull it out and the rest of your digital life comes apart in minutes.

The reason this matters so urgently in 2026 is that passwords, on their own, are no longer a meaningful defense. Billions of username and password pairs have leaked in data breaches over the years and now circulate on criminal marketplaces, sorted, searchable, and cheap. If you have reused a password anywhere, and most people have, the chances are uncomfortably high that one of your passwords is already sitting in one of those collections. Attackers do not laboriously guess passwords one at a time anymore; they take a known email address and a known password from a breach and try the pair, automatically, against hundreds of services, including your email provider. A password alone is a single lock, and the key to that lock may already be copied.

Two-factor authentication is the answer to exactly this problem, and it is the most important single thing you can do to protect your inbox. It adds a second, independent proof of identity on top of your password, so that knowing the password is no longer enough to get in. An attacker armed with your leaked password hits the second factor, something they do not have, and the break-in stalls before it starts. This guide explains what two-factor authentication is and why email needs it more than anything else, ranks the methods from strongest to weakest so you can choose well rather than blindly, walks you step by step through turning it on for Gmail and for Outlook and Microsoft accounts, and covers the parts people skip and later regret, backup codes, recovery, passkeys, and the app passwords that older mail programs still need. At the end, because we build one, we will explain how AI Emaily secures your own account and connects to your mail without ever seeing your email password.

What is two-factor authentication, and why does email need it most?

Two-factor authentication, usually shortened to 2FA, is a way of proving who you are using two different kinds of evidence instead of one. You may also see it called two-step verification, which Google and Microsoft prefer, or multi-factor authentication, MFA, the broader umbrella term that covers two or more factors. The names differ in the marketing; the idea underneath is identical. Logging in with a password alone is single-factor authentication, one piece of evidence. Two-factor authentication demands a second, of a fundamentally different type, before it lets you in.

Security professionals group the kinds of evidence into three categories, and the strength of 2FA comes from combining categories rather than stacking two of the same. The first category is something you know, a secret in your head, such as a password or a PIN. The second is something you have, a physical object in your possession, such as your phone, a hardware security key, or a one-time code generated by an app on a device you hold. The third is something you are, a biometric trait, such as your fingerprint or your face. A password plus a code from your phone combines the first and second categories: an attacker would need to both know your secret and physically possess your device, a far higher bar than knowing a secret alone.

The practical effect is straightforward and powerful. When 2FA is switched on, a thief who has stolen or guessed your password discovers that the password, the thing they worked to obtain, is no longer sufficient. They reach the second step, the prompt for a code or a tap or a fingerprint, and they are stuck, because they do not have your phone in their hand or your finger on the sensor. The login fails. The quantitative evidence for how much this helps is striking: Microsoft has reported that enabling multi-factor authentication blocks the overwhelming majority of automated account-compromise attacks, on the order of more than 99 percent. A second factor turns an account that a leaked password could open in seconds into one that a leaked password cannot open at all.

So why does email, specifically, need this more than any other account? Because of the master-key problem we opened with. The whole architecture of online account recovery rests on the assumption that your email is secure, since that is where reset links are sent. If your email lacks 2FA, then every other account you own, no matter how carefully you secured it individually, is only as safe as that one unprotected inbox, because they all reset through it. Putting strong two-factor authentication on your bank while leaving your email protected by a password alone is like fitting a steel door on the vault and leaving the key to it under the doormat. The email is the foundation. Secure the foundation and the rest of the structure has something to stand on. Leave it weak and nothing built on top of it is truly safe.

• Two-factor authentication requires two kinds of evidence to log in, not just a password.
• The three categories are something you know (password), something you have (phone or key), and something you are (biometrics).
• Strong 2FA combines two different categories, so a stolen password alone is not enough to get in.
• Microsoft reports that enabling MFA blocks more than 99 percent of automated account-takeover attacks.
• Email needs 2FA most because nearly every other account resets through it, making the inbox the master key.

Which 2FA methods are strongest, and which should you avoid?

Not all second factors are created equal. People often assume that any form of 2FA puts them in the same safe place, but the methods differ enormously in how well they resist a determined attacker. The single most important distinction is whether a method is phishing-resistant, meaning an attacker cannot trick you into handing it over even with a convincing fake login page. Methods that involve typing a code can, in principle, be phished, because anything you can type into the real site you can be tricked into typing into a fake one. Methods that never produce a code you could type are categorically harder to defeat. That single property does more to separate strong from weak than any other.

At the top of the ranking sit passkeys and hardware security keys, the gold standard precisely because they are phishing-resistant by design. Both rest on the same technology, a public-private key pair tied cryptographically to the specific website, so there is no code to read aloud, type, or be tricked out of you. A hardware security key is a small physical device, such as a YubiKey or a Google Titan key, that you plug in or tap; a passkey is the same idea stored on your phone or computer and unlocked with your fingerprint, face, or screen lock. Because the credential is bound to the real site's identity, it will not work on a lookalike phishing page, which is why Google, after rolling security keys out to its own staff, reported zero successful phishing takeovers of those accounts. If you protect nothing else this way, protect your email this way.

In the middle, a strong and practical choice for most people, are authenticator apps that generate time-based one-time passwords, the six-digit codes that refresh every thirty seconds. Apps such as Google Authenticator, Microsoft Authenticator, Authy, or 1Password produce these on your device from a shared secret set up once, and crucially they work entirely offline, with no signal or phone number required. They are far stronger than SMS because the code is generated locally and never crosses the phone network where it could be intercepted or redirected. Their one real weakness is that the code is still something you read and type, so a victim tricked by a convincing fake page in real time could be persuaded to enter it; that makes them good, but not phishing-proof the way a passkey is.

At the bottom of the ranking, to be used only when nothing better is available, is SMS, the text-message code sent to your phone number. It is genuinely better than no second factor, and it does stop the bulk, untargeted attacks that simply replay leaked passwords. But it is the weakest method by a wide margin, and the next section explains why in detail. The industry has reached a clear consensus on this hierarchy: standards bodies and major providers now actively steer users away from SMS and toward apps, passkeys, and keys. The table below lays out the ranking so you can choose deliberately rather than settle for whatever a service offers first.

Why is SMS the weakest form of 2FA?

SMS deserves its own section because it is the most common second factor in the world and, at the same time, the least secure, a dangerous combination. Most people who turn on 2FA turn on SMS, because it is the default many services offer and requires nothing but a phone number you already have. That ubiquity makes it worth understanding why security experts have spent years trying to move everyone off it. The short version is that SMS rests on the phone network, and the phone network was never designed to be a secure channel for authentication.

The headline threat is SIM swapping, also called a port-out attack, and it is why SMS 2FA can fail catastrophically against a targeted adversary. In a SIM swap, an attacker convinces your mobile carrier to transfer your phone number to a SIM card they control, sometimes by impersonating you to support with details harvested from breaches or social media, sometimes by bribing or tricking a store employee. The moment the number ports over, every SMS code meant to reach you, including your email 2FA codes, arrives on the attacker's phone instead. They then trigger a password reset on your email, receive the verification text, set a new password, and own your inbox, all without ever touching your actual phone. Because the code is delivered to the phone number rather than to a specific device you hold, taking over the number takes over the codes.

SIM swapping is not rare or theoretical; it is a thriving criminal specialty used to drain bank accounts, hijack social media handles, and empty cryptocurrency wallets, and the FBI has repeatedly warned about the steep rise in reported losses from it. But it is only the most dramatic of SMS's weaknesses. Text messages traverse carrier networks largely unencrypted, so they can in some cases be intercepted in transit through long-known flaws in the signaling protocols that connect carriers worldwide. Codes can be delayed or fail to arrive where coverage is poor, locking you out at the worst moment. And SMS codes are still typed, so a real-time phishing page can harvest them just as it would an authenticator code. Every one of these problems shares a root cause: your security is tied to a phone number, an identifier that your carrier, its staff, and anyone who can manipulate them can move out from under you.

The industry has responded, and 2026 is a turning point. Major mailbox and identity providers have begun phasing SMS sign-in down in favor of authenticator apps and passkeys, and standards bodies have for years advised against SMS as a primary factor for anything sensitive. None of this means you should rush to disable SMS where it is the only second factor you have, because SMS 2FA is better than none and does block the high-volume automated attacks that make up most takeover attempts. The right move is to add a stronger factor, an authenticator app or, better, a passkey, then demote SMS to a backup once something stronger is in place. Better still, where your carrier allows it, add a port-out PIN or number-lock so your number cannot be transferred without it, which directly blunts the SIM-swap threat.

How do you set up 2FA on Gmail and your Google account?

Gmail is the inbox most people most need to protect, both because of how many people use it and because a Google account often anchors a phone, a photo library, documents, and a great deal else besides email. Google calls the feature 2-Step Verification, and turning it on protects every Google service the account touches, not just Gmail. The setup lives in your Google account settings rather than inside the Gmail app itself, which trips some people up; you are securing the account, and email is one of the things that account guards. The whole process takes only a few minutes, and you can do it from a computer or a phone.

Before you start, decide which second factor you want, using the ranking from earlier in this guide. Google supports several: a passkey, which is the strongest and which we cover in its own section below; a Google prompt, the tap-to-approve notification that appears on a phone already signed in to your account; an authenticator app generating six-digit codes; a hardware security key; backup codes for emergencies; and SMS as a fallback. For most readers the best practical setup is to add a passkey if your device supports it, or an authenticator app if it does not, and to keep SMS only as a secondary option rather than the primary one. Whatever you choose, the steps to switch the feature on are the same; you simply pick your method during the flow.

Once 2-Step Verification is on, do one thing that people routinely skip and later regret: generate and save your backup codes immediately, before you ever need them. These are one-time-use codes that let you in if you lose access to your phone or key, and we cover how to store them safely in the next section. Set them up now, while you are already in the security settings, rather than discovering you have none on the day your phone falls in a lake. The steps below walk through the full setup on a computer; the mobile flow mirrors it closely.

1. 1

   Open your Google Account security settings

   Go to myaccount.google.com and select Security in the left menu, or visit the security page directly. Sign in if prompted.

2. 2

   Find 2-Step Verification and select it

   Under the heading How you sign in to Google, click 2-Step Verification, then choose Get started. Google will ask you to confirm your password.

3. 3

   Choose and confirm your second factor

   Pick your method: add a passkey or security key if offered, set up an authenticator app by scanning a QR code, or confirm a phone for Google prompts. Verify it once to prove it works.

4. 4

   Turn the feature on

   Confirm to enable 2-Step Verification. From now on, signing in to your Google account requires your password plus this second step.

5. 5

   Generate and save backup codes now

   Back in the 2-Step Verification settings, select Backup codes, then Get codes. Save the ten codes somewhere safe, such as a password manager, before you leave the page.

6. 6

   Review and prune your methods

   Add a second method as a backup (an app plus a passkey is ideal), and if SMS is listed as your only or primary option, demote it once a stronger method is in place.

How do you set up 2FA on Outlook and a Microsoft account?

If your email is an Outlook.com, Hotmail, Live, or Microsoft 365 personal address, the account you need to secure is your Microsoft account, and Microsoft, like Google, calls the feature two-step verification. As with Google, turning it on protects everything tied to that account, not only your inbox, which for many people includes a Windows sign-in, a OneDrive full of files, and an Xbox or Microsoft 365 subscription. The control lives in your account's security settings on the web, not buried inside the Outlook mail program, so you manage it from the Microsoft account site regardless of which app you read your mail in.

Microsoft's recommended second factor is the Microsoft Authenticator app, which can both generate codes and send tap-to-approve push notifications, and the company has been steadily steering users toward it and toward passkeys while phasing down SMS sign-in. During setup you can choose how you want to verify, an authenticator app, a phone number, an alternate email, or a security key or passkey, and Microsoft sensibly recommends registering more than one method and more than one contact address so a single lost device does not lock you out. Choose the strongest option available to you, following the same ranking as before: a passkey or the authenticator app ahead of SMS.

One Microsoft-specific wrinkle is worth flagging before you start, because it surprises people: turning on two-step verification can break older email programs that do not understand the second step, such as certain desktop mail clients or an old phone's built-in mail app. Microsoft's solution is the app password, a separate one-time-generated password you create for each such program. We explain app passwords fully later in this guide; for now, just know that if an old mail app stops connecting after you enable two-step verification, the fix is to generate an app password for it rather than to turn the protection back off. The steps below walk through enabling two-step verification on a Microsoft account from the web.

1. 1

   Sign in to your Microsoft account security page

   Go to account.microsoft.com, sign in, and open the Security tab. You may be asked to verify your identity before you can change security settings.

2. 2

   Open Advanced security options

   Select the Advanced security options tile. This is where Microsoft groups two-step verification, passkeys, app passwords, and your recovery methods.

3. 3

   Turn on two-step verification

   Under Additional security, find Two-step verification and select Turn on, then follow the prompts to confirm you want to enable it.

4. 4

   Choose and verify your method

   Set up your second factor: install and link the Microsoft Authenticator app, register a passkey or security key, or add a phone or alternate email. Verify it once so the account knows it works.

5. 5

   Register a backup method and recovery contact

   Add at least a second verification method and a backup email address or phone, so losing one device does not lock you out of the account entirely.

6. 6

   Create app passwords for older programs if needed

   If a legacy mail app stops connecting, return to Advanced security options, choose Create a new app password, and use that password in the older app instead of your normal one.

Are passkeys the passwordless future of email security?

Passkeys are the most significant change to how we log in since the password itself, and by 2026 they have moved from a promising idea to something the major email providers actively encourage you to use. A passkey replaces the password entirely, rather than merely adding a second step on top of it, and it does so in a way that is both more secure and, once set up, genuinely easier than typing a password and a code. Understanding what they are and why they are so strong is worth a few minutes, because for protecting your email there is no better option available, and the providers are nudging everyone toward them for good reason.

Technically, a passkey is a pair of cryptographic keys created for one specific website or service. The private key never leaves your device, stored securely in your phone, computer, or hardware key and protected by your fingerprint, face, or screen lock; the matching public key is held by the service. When you sign in, your device proves it holds the private key by performing a cryptographic operation, and you authorize that operation with your biometric or PIN. There is no shared secret transmitted, no code to read, and nothing typed that a fake site could capture. The single most important consequence is that passkeys are inherently phishing-resistant: because the key is bound to the real site's identity, it physically cannot be used on a fraudulent lookalike page, which removes the entire category of attack that defeats passwords and even defeats typed 2FA codes.

From your side, the experience is what makes passkeys spread. Instead of remembering a password and fishing a code out of an app, you tap a button and confirm with your face or thumb, and you are in. The passkey can sync securely across your devices through your platform's keychain, so one created on your phone is available on your laptop, and you can create passkeys on multiple devices for redundancy. Major providers, Google and Microsoft prominent among them, now let you sign in with a passkey, and a passkey can satisfy both the password and the second-factor steps at once, because possession of the unlocked device already proves both that it is you and that you hold the device. Setting one up generally means going to the same security settings where you enabled 2FA and choosing to add a passkey, then confirming with the device you want to store it on.

Two honest caveats keep this from being pure utopia, though neither is a reason to wait. First, passkeys are tied to devices and platforms, so a thoughtful person sets up more than one and keeps a fallback method, an authenticator app and saved backup codes, against the day a device is lost; this is the same redundancy advice that applies to every form of 2FA. Second, support, while now broad among major services, is not yet universal, so you will still meet accounts that offer only passwords and codes. The sensible posture for 2026 is to adopt passkeys everywhere they are offered, starting with your email, while keeping an authenticator app for the accounts that have not caught up. Passkeys are where login is going; your email is the best place to start going there.

What are backup codes, and how do you recover access if you lose your phone?

The single greatest fear that stops people from turning on 2FA is the worry that they will lock themselves out, and it is a reasonable fear, because it does happen, almost always to people who set up exactly one second factor and then lose access to it. The good news is that this is entirely preventable, and the prevention is built into every serious 2FA system: backup codes and redundant methods exist precisely so that losing a phone is an inconvenience rather than a catastrophe. The mistake is not turning on 2FA; the mistake is turning it on without setting up a way back in. Do the second part and the fear evaporates.

Backup codes, sometimes called recovery codes, are a short list of single-use codes, typically eight or ten, that a service generates when you enable 2FA. Each works exactly once as a substitute for your normal second factor, so if your phone is lost, stolen, or dead, you can type a backup code to get in and then set up a new factor. Because each is a fully valid second factor, treat them with the same seriousness as a password: store them somewhere safe and private, never in a plain note on the device you are protecting, never in an email to yourself in the very inbox they would unlock. A password manager is ideal; a printout in a locked drawer or a safe is a fine offline alternative. Generate them the moment you turn on 2FA, and regenerate a fresh set if you ever use several or suspect the list was exposed.

Backup codes are one layer, but the more robust strategy is to register more than one second factor in the first place, so a backup code is rarely needed at all. If you set up both a passkey and an authenticator app, losing your phone still leaves you the passkey on your laptop; add a hardware key and you have a third route in. This redundancy is the real answer to the lock-out fear, and it is why every step-by-step section above urges you to add at least two methods. Providers also offer account-level recovery paths, a recovery email, a recovery phone, trusted contacts, or an identity-verification process, and it is worth setting these up and keeping them current as the safety net beneath the safety net.

If the worst happens and you are locked out with no backup code and no second method, do not panic. Both Google and Microsoft run account-recovery processes for exactly this situation, where you prove your identity through other signals, devices you have used before, locations you sign in from, recovery contacts, and regain access over a period that can take minutes to several days depending on how much corroborating information you can provide. These processes are deliberately cautious, because a recovery path that is too easy is itself a way in for attackers, which is the best reason to never need them: set up two methods and save your backup codes today, so recovery is a fallback you read about rather than a crisis you live through.

• Backup codes are single-use codes that substitute for your second factor if you lose access to it.
• Treat them like passwords: store them in a password manager or a printout in a safe, never in the inbox they unlock.
• Generate them the moment you enable 2FA, and regenerate a fresh set if any are used or exposed.
• Register at least two second factors (for example a passkey plus an app) so a lost phone is not a lock-out.
• Keep your recovery email and phone current; Google and Microsoft offer identity-based recovery as a last resort.

What are app passwords, and do you still need them?

App passwords are the one piece of the 2FA puzzle that confuses people most, partly because the name sounds like it should be something you want and partly because they are a workaround for an older era of email software. Understanding them matters because if you turn on 2FA and an older mail program suddenly stops connecting, the app password is the fix, and not knowing about it leads people to wrongly conclude that 2FA broke their email and to turn the protection off. It did not break anything; it simply revealed an app that cannot speak the modern login language.

Here is the problem app passwords solve. When you enable 2FA, signing in now involves an interactive second step, a prompt, a tap, a code, a biometric. Modern apps and the web handle this fine, because they are built to present that step to you. But some older software, written before 2FA existed, only knows how to send a username and a password, with no way to complete a second step. Such a program, an old desktop mail client, a legacy phone mail app, a printer that emails scans, simply fails to log in once 2FA is on, because it cannot perform the second factor. The app password is the bridge: a long, randomly generated, single-purpose password you create for that one program, which it uses in place of your normal password, and which works without triggering the interactive second step.

Crucially, an app password does not weaken your 2FA in the way it might first appear, because of how it is scoped. Each app password is generated for a single application, can be revoked individually at any time without affecting your main password or your other apps, and is created only by someone who has already passed full 2FA to reach the settings. If a device using an app password is lost or compromised, you revoke just that one password from your account security page and every other access remains intact. They are a controlled exception, not a hole. Both Google and Microsoft let you create and manage them in the same security settings where you enabled 2FA, usually under an app passwords section that appears once 2FA is active.

The honest trend, though, is that app passwords are on their way out, and you increasingly will not need them. The reason is that the industry has moved to a better mechanism, modern authentication built on OAuth, which lets an application connect to your mail through a secure, permission-based authorization flow that fully supports 2FA, rather than by holding a password at all. Most current mail apps and services now use this approach, which is both more secure and more convenient, since there is no separate password to generate or revoke and the app never holds your real credentials. App passwords remain useful for genuinely old software that cannot do OAuth, but the direction of travel is clear: as more of your tools adopt modern authorization, the need to generate app passwords fades. This shift toward password-free connection is, as it happens, exactly the approach we take with AI Emaily, which we turn to next.

How does AI Emaily secure your account and connect without ever seeing your password?

Everything in this guide leads to the same conclusion: your email account deserves the strongest protection you can give it, and any tool that touches your mail should respect that rather than undermine it. AI Emaily is built on exactly that principle. We secure your AI Emaily account itself with two-factor authentication, and just as importantly, when you connect the email accounts you already use, we connect through minimum-scope OAuth, the modern, permission-based authorization we described in the last section, which means we never see, ask for, or store your actual email password. The protection you spent this guide setting up stays fully intact, because we plug into it rather than around it.

It is worth being precise about what that means, because it is the heart of how a trustworthy AI email tool should work. When you link a mailbox to AI Emaily, you are not handing us your email password and not creating an app password for us to hold. Instead you authorize the connection through your provider's own OAuth flow, the same secure, consent-based handshake that powers Sign in with Google and similar buttons across the web. Your provider issues us a scoped access token granting only the permissions needed to do the job, and your password never passes through us at any point. Because the grant is scoped and revocable, you can see exactly what you authorized and withdraw it at any time from your provider's settings, and the connection ends without anything of yours left behind on our side.

We treat the credential that authorization produces with the seriousness it demands. The access tokens that let AI Emaily connect to your mailbox are envelope-encrypted in storage, protected so that the sensitive material is never left sitting in plain form, and they are never logged or exposed in transit. AI Emaily works across every email provider you already use, so you secure each provider account with the strong 2FA this guide recommends, connect them through minimum-scope OAuth, and get one private, AI-powered inbox on top, without ever loosening the account security underneath or trusting us with the password that guards it. There is no step where good security has to be traded away for the convenience of the tool, which is precisely the trade we built the product to avoid.

Privacy sits underneath all of this, because for a tool that reads your mail it is the whole foundation rather than a feature. AI Emaily is built to be private and does not train its models on your email; the access we are granted exists to serve you inside your own inbox, not to mine your correspondence. If you want to see how it works on your own mail, you can try it free. The Free plan costs nothing and lets you connect an account, secured by your own 2FA, through minimum-scope OAuth and experience the AI inbox without handing over a password. If it earns a place in your day, the Pro plan is 17.99 dollars a month billed annually and adds the fuller set of capabilities. You can create an account in a couple of minutes at app.aiemaily.com/signup and connect your first mailbox without ever typing your email password into anything but your provider's own login.

The bottom line on two-factor authentication for email

Two-factor authentication for email is not one security task among many; it is the foundational one, because your inbox is the master key that resets nearly every other account you own. A password alone, in a world where billions of them have already leaked, is a single lock whose key may already be copied. Adding a second factor turns that single lock into a real barrier, one that a stolen password cannot pass, and the data backs it up: enabling MFA blocks the overwhelming majority of automated account takeovers. If you do one thing for your online security this week, switch on 2FA for your email, and do it before you secure anything else.

Choose your method deliberately rather than accepting the first one offered. Passkeys and hardware security keys sit at the top because they are phishing-resistant by design, with nothing to type and nothing to be tricked out of you; authenticator apps are a strong and practical middle choice that works offline and resists SIM swaps; and SMS, while genuinely better than no second factor, is the weakest by a wide margin and should be a last resort or a backup, never your only line of defense against a determined attacker. Whatever you pick, set up at least two methods and generate your backup codes the moment you turn the feature on, because the only real way to lock yourself out is to rely on a single factor and lose it. We walked through the exact steps for Gmail and Microsoft accounts above; each takes about five minutes.

Finally, hold every tool that touches your mail to the same standard you just set for the account itself. The right way for an email assistant to connect is by permission, not by password, through minimum-scope OAuth that leaves your 2FA fully in force and never asks for the credential that guards your inbox. That is the standard we built AI Emaily to meet: strong 2FA on your account, password-free connection to every provider you use, scoped tokens kept envelope-encrypted and never logged, and a private inbox that does not train on your mail. Secure your email first, with the strongest second factor you can, and then, if you want the inbox to work harder for you without ever weakening that security, you can try AI Emaily free at app.aiemaily.com/signup and connect your first account without typing your password into anything but your provider's own login screen.