TL;DR: We're now making all connections to the FastMail web interface immediately redirect to a secure (https) connection.

As part of our commitment to making all connections between users computers and our servers secure and encrypted, we’ve just made some changes to our webmail login page. In most cases, users won’t notice any change because we made Secure Login the default almost a year ago. The new changes will only affect the small number of users that have special login requirements.

The main change we’re making is that where previously we would redirect from an insecure (http) to secure (https) connection during login, or on returning to FastMail on a computer you’d logged in via before, we will now redirect to the secure login screen immediately when you connect to FastMail. That is, as soon as you go to (insecure) or (insecure), we’ll always redirect to (secure).

Going to other https:// domains that aren't supported (e.g., a secure connection, but will report a
certificate error) will redirect to as well.

This will also be the case for businesses and families that use their own domain for logging in (e.g., they’ll also be redirected to, but we will continue to correctly show the family/business login screen.

There are a couple of additional exceptions to this.

The mobile UI domains that start with the http://m. prefix like (insecure) and (insecure)
will redirect to (secure). This will always show the mobile login screen and mobile interface when you login.

The special "sticky ssl" domains that start with the https://ssl. prefix like (secure) and (secure, but certificate warning) will "stick" to
that domain. This may be useful as a work around for some proxies that block hostnames with the word "mail" in them.

If for some reason you need to use an insecure login (which we highly recommend you do not do), you will explicitly need to go to the URL If you use this to login, data sent between your computer and our server will travel unencrypted over the Internet. This service is only provided for dire circumstances, is highly discouraged, and may be removed in the future.

For the curious, here's a list of all the transitions that should happen. The "(W)" means you'll see a certificate warning about mismatched hostnames.               -> stays at                    ->                       ->                ->                   ->                   -> (W)                  ->      -> (W) ->                  ->                     ->                 -> stays at (W)                ->                ->                   -> (W)               -> stays at (W)              -> stays at (W)           -> stays at              -> stays at