Account security

Your Heron account gives access to all your mailboxes through Heron. Here’s how to protect it, and what Heron does on its side.

Change your Heron password

• On a computer: Settings (⌘ , or Ctrl ,) → Heron account. Enter your Current password, the New password (8 characters min.) and its confirmation, then click Change password.
• On mobile: Settings → Heron Account → Change Password.

Then use the new password to sign in on your other devices.

Good to know: your Heron password has nothing to do with your mailbox passwords. Changing one doesn’t change the others.

Sign out of a device

Settings → Heron account → Sign out (on mobile: Settings → Heron Account → Sign Out). Your mailboxes stay set up on your account: sign back in and they’re there.

Lost track of a device? See Manage your devices.

How Heron protects your credentials

• Google and Microsoft: with Sign in with Google or Sign in with Microsoft, Heron never sees your password. You can revoke access at any time from your Google or Microsoft account.
• Other mailbox passwords: they’re encrypted (AES-256-GCM) before being stored. Prefer an app password when your provider offers one: you can revoke it without changing your main password.
• Email content: Heron doesn’t keep full message bodies or attachments; they’re read from your mail server when you open them.
• Tracking images: remote images are blocked by default so senders can’t tell when you open an email. See Remote images.

Spot a suspicious email

Open a message’s More Actions menu → Show Headers (⇧ ⌘ H, or Ctrl Shift H). Heron shows the SPF, DKIM and DMARC checks and the message’s route from server to server: a failure is a strong hint of spoofing.

AI agents

If you connect Claude or another assistant, you choose mailbox by mailbox what it can do. See Security best practices.