eM Client saves your account passwords so you don't have to type them each time. By default, they are protected by the security of your computer and your user account. If you need protection even when someone gets a copy of your eM Client data files, turn on the optional Password protected startup.
This article explains what each level of protection covers, so you can choose the right one.
Default Protection (No Password Protection)
Without password protection, eM Client stores saved passwords in an obfuscated form in your local data folder. eM Client can read them automatically, so nothing is asked of you at startup.
This follows the same approach as most desktop email clients. Its protection depends on your device:
| Situation | Are saved passwords protected? |
|---|
| Someone without access to your computer or files | Yes |
| Another person using your computer without your account password | Yes, as long as your OS account and disk are secured |
| Someone logged in as you, or malware running under your account | No. They can already use eM Client and read your mail as you |
| Someone with a copy of your eM Client data folder (backup, old disk, copied files) | No. The passwords can be recovered from the copy |
If the last row matters to you, enable the Password protected startup.
What the Password Protected Startup Adds
With password protection your saved passwords are encrypted with a key derived from a password only you know. eM Client does not store the master password itself.
A copied data folder, backup or old disk is useless without the master password.
eM Client asks for the master password when it starts, before it can connect to your accounts.
If you forget the master password, the saved passwords cannot be recovered. You will need to enter your account passwords again.
The master password does not protect against malware or a person already using eM Client in your unlocked session. No local protection can, since eM Client must decrypt the passwords to use them.
Who Should Enable Password Protection
We recommend the password protection if any of these apply:
Your computer is shared, or used by several people under one account.
Your eM Client data folder is backed up to cloud storage, a NAS or a company backup system.
You use a laptop that could be lost or stolen, especially without full-disk encryption (BitLocker or FileVault).
Your organization's security policy requires stored credentials to be encrypted with a user secret.
You will hand over or dispose of the computer, or send your data folder to someone (for example, to support).
How to Enable the Password Protection
Open eM Client and go to Settings > General > Password Protection.
Turn on the Password protected startup.
Enter a strong password you don't use anywhere else, and confirm it.
Restart eM Client. It will ask for the master password at startup.
Note: Store the master password somewhere safe, such as a password manager. eM Client cannot recover it for you.
Other Ways to Protect Your Accounts
Lock your OS account: Use a strong password and lock the screen when you step away.
Turn on full-disk encryption: BitLocker on Windows or FileVault on macOS means a lost or stolen device doesn't expose your files.
Encrypt your backups: Especially when they leave your computer.
Sign in with OAuth where your provider supports it: For example Google or Microsoft 365. eM Client then stores a revocable token instead of your account password.
Use app passwords or two-factor authentication: Where available, so a leaked password alone isn't enough to access your account.
FAQ
Why isn't the password protection on by default?
It has to be entered at every start, and a forgotten master password means re-entering every account password. Many users prefer to rely on their OS account and disk encryption, so we leave the choice to you.
Can someone with my data folder read my saved passwords?
Without a master password, yes. With a master password, no.
Does the password protection encrypt my emails too?
No. It protects saved account passwords. To protect stored mail, use full-disk encryption.
I found a security issue. How do I report it?
Contact us at [email protected]. We review every report.