User settings (webmail)

Purpose. Everything a mailbox owner can change about their own account without an admin: password, signature, display preferences, autoresponder, filters, forwarding, and their consent to AI features.

Layout. Settings is nine sections, each at its own URL, so a link can open the one it means (the AI panel’s prompt opens /settings/ai). They were regrouped on 2026-10-19: the compose settings and the signature left General for a section of their own, and Mail rules became Vacation responder and Filters. /settings/rules redirects to /settings/filters, so an old link still lands. Categories, Profile and Notifications were added the same day, and Categories is shown in the nav only when the mailbox’s domain allows categories. The command palette lists Settings: Categories whatever the domain allows; reached that way, or by its URL, the section opens as usual, but the Inbox shows no tabs while the domain does not allow them. Each section saves only its own settings, which the API merges over the rest.

Section	URL	What is in it
General	/settings/general	language, theme, messages per page, the reading pane, density, conversations, pinned messages at the top
Compose & signature	/settings/compose	undo send, plain-text compose, quoting, the signature and where it goes by itself
Profile	/settings/profile	the picture (or the initials’ colour) and the display name
Notifications	/settings/notifications	desktop notifications in this browser: on or off, which mail, a sound
Vacation responder	/settings/vacation	the autoresponder
Filters	/settings/filters	filters, or a raw Sieve script
Categories	/settings/categories	inbox categories on or off, and each category (Inbox categories)
Security	/settings/security	password, two-factor authentication, app passwords
AI features	/settings/ai	the consent switch — listed only when the mailbox can turn it on

On a wide screen the sections are a side nav and /settings opens General. On a phone /settings is the list of sections, and each section opens on its own page with a link back to the list.

Behaviour (API under /mail/account*, /mail/avatars/*, /mail/filters*, /mail/autoresponder):

• Password — PUT /mail/account/password { current, password }; requires the current password, and a wrong one counts against the same failed-attempt budget as a failed sign-in, for the address and the IP it came from (Login rate limiting & brute-force lockout); ≥ 10 characters; audited (mailbox.password_change). Every webmail session of the mailbox ends, and the browser that made the change is handed a new one, so it stays signed in; an administrator’s on-behalf session is not renewed and ends. It also holds every message waiting to be sent later, the changer’s own included: each shows Not sent under Scheduled until it is sent or given a new time. Existing IMAP/SMTP clients keep working until they reconnect.
• Language — locale, a BCP-47 tag or auto. auto follows the browser’s language list (navigator.languages); a chosen language applies to this mailbox on every device, and is also cached in the browser so the next load renders correctly before the account query answers. The menu lists whatever catalogues the build ships, each named in its own language (Internationalisation).
• Signature — edited in a rich-text editor (TipTap): bold, italic, underline, colour, links (web, mailto:, tel:), images by https address, a bulleted list, centring and a divider, with an HTML view for pasting a signature you already have. Saved as HTML with signatureHtml: true, and cleaned by the API before it is stored (sanitizeSignature, an allowlist: no script, event handlers, frames, forms, or styles beyond colour, alignment and emphasis; images over https only, so a signature cannot carry a plain-http pixel or a data: payload). Up to 10,000 characters. A plain-text signature from before the editor opens as paragraphs and is saved as HTML from then on. In the rich-text composer the signature is drafted as itself, formatted, under a -- line, and is edited like the rest of the message. In the plain-text composer (Write messages in plain text) the draft carries the signature’s plain-text rendering after -- (below the body, above the quote in replies), and on send the HTML part carries the formatted signature in its place — as long as those lines are still exactly as drafted. Edit or delete them and the edit is what is sent. Where it goes by itself: Add my signature to every message I send (signatureAuto) and, under it, Also on replies and forwards (signatureOnReplies), both on by default. Off, the composer’s Insert signature adds it to the message in front of you.
• Display — theme (system/light/dark, also in the header toggle and the command palette), the reading pane (beside the list, below it, or off, which opens a message in place of the list, as a phone always does) and density (comfortable or compact rows), whether pinned messages are grouped at the top of their folder (pinnedAtTop, on by default), messages per page, conversation grouping (threaded, also the icon toggle at the right of the mailbox filter bar), quote the original on reply (replyQuote), write messages in plain text (composePlain, off by default — see Compose, send and drafts), undo-send window (0–30 s). Until 2026-10-01 Quote the original message in replies was saved and ignored: every reply quoted.
• Autoresponder and Filters — the autoresponder’s dates are one Away range picked on a calendar, as whole days in your time zone; the same filter list and editor as the admin’s mailbox page, plus Try it on your mail (Mailbox filters & autoresponders), scoped to the signed-in mailbox (GET/PUT /mail/filters, POST /mail/filters/{check,compile,try,apply}, GET/PUT /mail/autoresponder).
• Profile — the picture: a PNG, JPEG or WebP photo, dragged and zoomed into a circle (or moved with the arrow keys) and stored as a 256 px image of at most 64 kB (PUT/DELETE /mail/account/avatar, a data URL whose bytes must be the type it says: 400 avatar_not_an_image, 413 avatar_too_large); without one, the initials on a colour chosen here (avatarColour). It is shown in the header, on the mailbox’s messages in the list and the reader, and in recipient chips — to the mailbox itself and to every other mailbox in its tenant (on an install, which has one tenant, every mailbox on the server), never to anyone outside: POST /mail/avatars/lookup says which addresses are mailboxes here (with their colour and their picture’s version) and GET /mail/avatars/{address} returns the image, both only to a signed-in mailbox of the same tenant, and the image only through the API client, since an <img src> would carry no session. The display name (PUT /mail/account/profile) is what recipients see, Name <address>.
• Notifications — set per browser, in its localStorage, because the permission is the browser’s: a second browser asks again and starts off. The preferences are one entry for the browser, not one per mailbox, so two mailboxes signed in to the same browser share them. On, a message arriving in the Inbox while the webmail’s tab is in the background raises a browser notification (the sender and the subject; more than three at once, one saying how many), and clicking it brings the tab forward on that message. Which mail: all of it, only mail marked important or from people this mailbox has written to (the top 50 of /mail/contacts), or, while categories are on, only Primary; an optional chime, made in the browser. It rides the stream the webmail already holds (/mail/events): its exists names the Inbox’s count but no message, so the client keeps the highest uid it has seen and reads the newest messages above it. A tab that is closed notifies nobody: there is no push service behind it.
• Forwarding — a filter rule with a redirect action (keep a copy or not). Admin-defined forwarders on the mailbox are not shown here: GET /mail/account does not return them and the settings screen renders nothing for them, so a user cannot see a forward an administrator set.
• Storage — quota and usage from the account card.
• AI features — the mailbox owner’s own consent: one switch, read from GET /ai/availability (optedIn) and set with PUT /ai/opt-in, audited as ai.opt-in / ai.opt-out (AI privacy controls). The card — and the section’s entry in the nav — is absent, not disabled, when a gate above the user is closed — no provider on the server, or AI switched off for the domain (canOptIn: false) — because a switch that cannot take effect is worse than none. The AI panel’s prompt links a user who has not opted in to /settings/ai; reached by URL with a gate closed, the section says AI is unavailable and why rather than rendering nothing. Until 2026-09-26 it had no card at all, and the prompt pointed at a switch that did not exist.

Configuration. PUT /mail/account/settings takes only the keys it changes and merges them over what is stored; until 2026-10-01 every key it left out was reset to its default, so the mailbox’s conversation toggle reset the signature, theme, language, page size and undo window with it. Preferences live in mailbox_settings.settings (JSON, MailboxSettings schema with defaults); missing keys fall back to defaults so new settings never break old rows — which is why locale needed no migration. It is validated as a shape (auto, or a language tag) rather than against a list of the languages we ship: the catalogues are a fact about the front-end build, and a server that enumerated them would need redeploying to accept a contributed language.

Limits & edge cases.

• App passwords and two-factor authentication are in the Security section, in their own cards, with how many recovery codes are left and the action that generates a new set — see App passwords and mailbox two-factor authentication.
• Settings are per mailbox, not per browser, the theme included: choosing it in Settings, the header toggle or the command palette applies it at once and saves it to the mailbox, and a browser signing in to the mailbox starts in it. A browser whose only choice was made with the header toggle before it saved anything takes the mailbox’s saved theme instead, system unless it was set. An administrator who has borrowed the mailbox sees the owner’s theme, and their own toggling stays in their browser rather than changing the owner’s setting. The admin panel and the sign-in page have no mailbox, so their toggle is this browser’s alone.