How to Open a Firstmail Mailbox, in the Browser or over IMAP
October 19, 2026
BuyFirstmailAccounts Help· Customer support
A Firstmail mailbox is delivered as one line on your order page: an address and a password. Accounts sold with a Firstmail mailbox carry the same two fields somewhere inside a longer line. This guide shows how to open the mailbox, in a browser or in a mail app, and then how to find the mailbox inside each kind of account line.
One thing to know before you start: Firstmail mailboxes receive mail only. You can read codes and confirmation links in them, but you cannot send or reply.
The mailbox line
river.lane2041@example.com:Passw0rd!2041Left of the colon is the address, right of it the password. The domain will look unfamiliar, often an invented word with "mail" in it and a .com, .net or .live ending: Firstmail places its mailboxes on many domains of its own, and none of them ends in firstmail.ltd. That is normal, and the sign-in page is the same for all of them.
Route one: the webmail
- Open firstmail.ltd/webmail/login.
- Type the full address, domain included.
- Paste the password. Copy it on its own, so the colon does not come along.
- The inbox opens. New messages appear at the top; refresh the page if you are waiting for one.
Route two: a mail app over IMAP
Listings that say IMAP can be added to Thunderbird, Outlook, a phone's mail app or a tool that reads codes automatically. Choose to add an account manually and enter:
| Setting | Value |
|---|---|
| Account type | IMAP |
| Incoming server | imap.firstmail.ltd |
| Port and security | 993, SSL/TLS |
| User name | The full address from your line |
| Password | The password from your line |
| Outgoing server (SMTP) | None. The mailbox cannot send, so skip this step or leave it empty |
The one listing that names POP3 also accepts POP3 on the same server at port 995. If the app insists on an outgoing server before it saves the account, use the webmail instead.
Accounts that come with a Firstmail mailbox
On these listings the mailbox is part of a longer line. The listing title gives the order of the fields; these are the shapes you will meet:
| Listing | Line shape | Where the mailbox is |
|---|---|---|
| Steam, Instagram | login:password:email:email password | Fields 3 and 4 |
| Instagram with cookies | login:password:2FA||cookies||mail:mail password | The part after the second || |
| Outlook | email:password:refresh token:client ID:recovery email:recovery password | The last two fields: the Firstmail recovery mailbox |
| X | username:password:mail:mail password:2FA:ct0:auth_token | Fields 3 and 4 (some X lines put the token first; the title says) |
Open the mailbox part with the webmail steps above. Whenever the other service sends a sign-in code or a confirmation link, it lands there.
The other fields
- 2FA key: a run of capital letters and digits. When the service asks for a code, paste the key into https://checkkit.net/en/online-2fa-code-generator and type the six digits it shows within 30 seconds.
- Cookies: a long block of text. Install the Cookie-Editor browser extension, open the service's website, import the block with Cookie-Editor and reload the page.
- auth_token (X): a saved X session. Add X Token Login from the Chrome Web Store, paste the token into it and X opens signed in.
- Refresh token and client ID (Outlook): for mail tools that read Outlook through Microsoft's login. To use the mailbox yourself, sign in at outlook.com with the first two fields; Microsoft sends its security codes to the Firstmail recovery mailbox.
Once you are in, change the account's password, and switch on two-factor with your own authenticator where the service offers it. A changed password ends any cookie or token session that came with the line.
When the code does not come
The webmail refuses the password
Copy the password again on its own and check the address has its full domain. Try once more, then stop and report the line.
Nothing arrives
Look in the spam folder, wait two minutes and ask the site to resend. Some sites refuse certain domains outright; if a site says the address is not accepted, that is the site's choice, not a mailbox fault, and sellers do not swap domains. Test a few addresses on that site before you buy more.
Old messages are gone
Some listings clear stored mail when nothing new arrives for 35 days. Save anything you need to keep somewhere else.
Reporting it
Open a ticket from your order page inside the warranty window shown on the listing; on several listings it is only a few hours. Include the address of the line and a screenshot of the error. You get a replacement from the same listing, or a refund when it is empty. Signing in never voids the warranty; blocks after bulk or automated activity are not covered. The home page explains how the listings differ.