The web sign-in page asks for your email first, then shows the way to sign in that fits that address. The business sign-in page at /org/login works the same way.
Step 1: your email#
Enter your email and select Next. If your browser has a passkey saved for SipherMail, it can offer it in the email field’s autofill list. Choosing it signs you in without typing anything else. This needs a browser that supports passkey autofill. Without it, you use the steps below.
Your browser may remember the last email you used as a suggestion. It never signs you in on its own.
Step 2: the way to sign in#
| If this applies | You see |
|---|---|
| The account has a passkey enabled for sign-in | Continue with passkey. Your device asks you to confirm it is you. Use password instead appears if the account has a password. |
| Your organisation uses single sign-on | A message that your organisation signs you in with single sign-on, and a Continue button that opens your identity provider. |
| Anything else | A password field with Show and Forgot password?. |
Your email is shown at the top of this step with a Change link. Use another way to sign in lists the other methods available for the address. It also links to Recover your account if you forgot your password or lost your passkey.
The page shows the password step for addresses it cannot match to an account, for locked accounts and for accounts it cannot use. It does not say whether an account exists. A wrong email or password gets the same message either way.
After the first step#
- Two-step code. If two-factor is on, enter your code after the password. See Two-factor authentication. A passkey sign-in does not ask for a second code, because the passkey and your device check count as two factors.
- New device approval. If you use approval from a trusted phone, a password sign-in asks you to approve it there. A passkey sign-in on a device that is not yet trusted asks you to sign in with your password once first.
- Lockout. Repeated wrong passwords lock sign-in for 15 minutes. Passkey sign-in follows the same lockout.
Single sign-on#
If your organisation requires single sign-on, password and passkey sign-in are refused for your address, except for the organisation Owner’s break-glass password route. If it does not require it, Use another way offers your password. See Single sign-on.
Limits#
The page limits how often it can be asked which method to show, per network and per email. If you see "Too many attempts", wait a few minutes.