Email & webmail account security directory

13verified services

5passkey confirmations

12documented 2FA records

Independent snapshot: A feature is shown only when it is present in the verified project data. Unknown fields do not mean the service lacks that capability.

Service	Passkey record	2FA methods	Reviewed
AOL Mail login.aol.com	Not yet documented	Text message, Authenticator app	2026-08-27
AT&T Mail more.att.com	Not yet documented	Email code, Text message	2026-09-10
EarthLink Webmail webmail.earthlink.net	Not yet documented	Authenticator app, Text message	2026-09-10
Fastmail app.fastmail.com	Confirmed	Authenticator app, Text message, Security key, Backup codes, Passkey used as an additional factor	2026-07-28
Gmail accounts.google.com	Confirmed	Authenticator app, Text message, Security key, Approval prompt, Backup codes, Passkey used as an additional factor	2026-07-28
iCloud www.icloud.com	Not yet documented	Approval prompt, Text message, Security key	2026-08-27
Optimum Email webmail.optimum.net	Not yet documented	Not yet documented	2026-09-10
Outlook login.live.com	Confirmed	Authenticator app, Email code, Approval prompt, Security key, Passkey used as an additional factor	2026-07-28
Proton Mail account.proton.me	Not yet documented	Authenticator app, Security key, Backup codes	2026-07-28
Spectrum Email www.mail3.spectrum.net	Not yet documented	Email code, Text message	2026-09-06
Tuta Mail app.tuta.com	Not yet documented	Authenticator app, Security key, Backup codes	2026-07-28
Yahoo Mail login.yahoo.com	Confirmed	Authenticator app, Text message, Approval prompt, Passkey used as an additional factor	2026-07-28
Zoho Mail accounts.zoho.com	Confirmed	Authenticator app, Text message, Security key, Approval prompt, Backup codes, Passkey used as an additional factor	2026-07-28

Using this category view

Start with the service, then confirm its current settings

These rows are a research index, not an authentication interface. Open the independent guide to see the verified official domain and provider-owned help sources. Security options may differ by account type, device, region, or staged product rollout.

Help improve coverage without guessing

A missing method should stay unknown until an official provider source supports the claim. When a record is updated, its content date changes independently; rebuilding unrelated pages does not create a false freshness signal in the sitemap.