Why is there no password?

Passwords are the highest-frequency credential-leak vector in email and rotate manually. Magic-link auth (a fifteen-minute, single-use token sent to your address) replaces the password without losing the ownership proof — only the person reading the email can complete sign-in.

What happens if I lose access to my sign-in address?

Add a backup sign-in address or a passkey in /app/security before you need it. A sign-in link sent to the backup address opens the same account, so if your first mailbox is unreachable you sign in through the second. Pick a backup whose mail doesn't come through Folio — it matters most when your sign-in address is on a domain you receive through Folio, because then the sign-in link lands inside the account it opens.

Is my mail encrypted at rest?

Yes. Raw messages are stored in Amazon S3 and the reading index in DynamoDB, both encrypted at rest. DKIM private keys are additionally Fernet-encrypted at the application layer before being written to the database.

Do you support encrypted inbound mail?

Yes. Haraka offers authenticated STARTTLS with a publicly trusted certificate. A customer domain can opt into managed Inbound TLS protection from its domain page: Folio hosts and updates the policy and certificate, and the owner publishes three DNS records once. It starts in testing mode, which reports failures without delaying mail; enforcement follows when the checks pass. Existing policies are detected before setup.

Magic-link sign-in

Folio uses magic-link authentication — no password to leak or phish. Sign-in requests a single-use link valid for fifteen minutes, scoped to the address you typed. At-rest data is encrypted in Amazon S3 and DynamoDB; web and API traffic is TLS-only. The inbound MTA offers authenticated STARTTLS, with managed MTA-STS available for customer domains in testing mode before enforcement. Per-domain DKIM private keys are Fernet-encrypted in the database.

No password to remember, lose, or share. A one-time link to the address you already check.

Oct 2026· Updated 2026-10-18·3 min read

We chose passwordless sign-in for two reasons. One: passwords are the single most common credential to leak, and the most common reason accounts are compromised. Two: the address you're reading this mail at is already proof that you control it — asking for a password on top is a formality.

§ The token

Validity: 15 minutes from the moment it leaves our servers.
Use count: Single-use. Once clicked, the token is marked spent and rejected on reuse.
Storage: Hashed at rest; the raw token never touches our database.
Transport: TLS 1.3 in flight, DKIM-signed in transit.

§ The session

Clicking the link mints a JWT session valid for thirty days. It rides in an HttpOnly; Secure; SameSite=Lax cookie, so JavaScript in the page cannot read it and the browser will refuse to send it cross-site. Sign out from the sidebar footer at any time to invalidate it immediately.

§ Revocation

If you suspect your session has been taken — an unfamiliar location, an unfamiliar device — the Sign out everywhere action on /app/security rotates your session key server-side. Every session issued before you pressed it, on every other browser and phone, is refused on its next request, and its refresh token stops working too. The device you pressed it on gets a fresh session and stays signed in. The same press disconnects every connected AI app and access key, since either could outlive a stolen session; reconnect the ones you still use afterwards.

§ Common questions

Why is there no password?: Passwords are the highest-frequency credential-leak vector in email and rotate manually. Magic-link auth (a fifteen-minute, single-use token sent to your address) replaces the password without losing the ownership proof — only the person reading the email can complete sign-in.
What happens if I lose access to my sign-in address?: Add a backup sign-in address or a passkey in /app/security before you need it. A sign-in link sent to the backup address opens the same account, so if your first mailbox is unreachable you sign in through the second. Pick a backup whose mail doesn't come through Folio — it matters most when your sign-in address is on a domain you receive through Folio, because then the sign-in link lands inside the account it opens.
Is my mail encrypted at rest?: Yes. Raw messages are stored in Amazon S3 and the reading index in DynamoDB, both encrypted at rest. DKIM private keys are additionally Fernet-encrypted at the application layer before being written to the database.
Do you support encrypted inbound mail?: Yes. Haraka offers authenticated STARTTLS with a publicly trusted certificate. A customer domain can opt into managed Inbound TLS protection from its domain page: Folio hosts and updates the policy and certificate, and the owner publishes three DNS records once. It starts in testing mode, which reports failures without delaying mail; enforcement follows when the checks pass. Existing policies are detected before setup.