mailtag
Blog / Guides
What is an app password, and what is it for?
- An app password is a separate code your email provider creates for one app. The app opens your mail with it and never sees your real password.
- You need one in apps that only ask for a username and password. If the app offers "Sign in with Google" or similar, use that.
- Delete it anytime without changing your password. Outlook.com and Microsoft 365 no longer accept them for IMAP.
You want to add your email to Thunderbird, another phone, a printer or a service that sorts your inbox. The app asks for your password, you type yours, and it fails, even though it's right. The help page then mentions an "app password".
Here's what it is, why it exists, when you need one and the risks. The steps differ at every provider, so each has its own guide, linked at the end.
What an app password is
An app password is a random code you generate on your email provider's website for one specific app. At Gmail it's 16 letters; other providers use other formats. Apple calls it an "app-specific password", but it's the same thing.
You paste it into the app where it asks for the password, next to your usual email address. From then on, the app opens your mailbox with that code instead of your main password.
It only opens email (depending on the provider, also calendar and contacts), and it's for one app: you can delete your phone's without touching Thunderbird's.
| Your password | App password | |
|---|---|---|
| Signs in to the provider's website | Yes | No |
| Changes your settings and security | Yes | No |
| Reads and sends mail from an app | Hardly ever now | Yes |
| Can be revoked without affecting anything else | No | Yes |
| Asks for your second step, if you have one | Yes | No |
Why they exist
Classic email apps connect with IMAP, the standard way to download emails from the server. IMAP dates from the 1980s and was built around a username and password. Many apps still ask only for those, and they can't show you Google's page to confirm on your phone or ask for a six-digit code.
When providers added two-step verification, those apps were left out. The app password was the fix: a code the app can type on its own, with nothing to confirm.
Over the years, providers have closed IMAP to your normal password. Google stopped accepting it on 14 March 2025, with app passwords as the exception (Workspace help). That's why your correct password "doesn't work": the server isn't saying it's wrong, it no longer allows that kind of sign-in.
When you need one (and when you don't)
You don't need one if the app lets you sign in on your provider's page. That's the "Sign in with Google", "with Microsoft" or "with Yahoo" button. This way of signing in is called OAuth. Google itself says app passwords are "unnecessary in most cases" and recommends that button where it exists (Google help). The provider's own apps don't need one either, like Mail on the iPhone with iCloud.
You need one when the app only asks for a server, username and password. That happens with Thunderbird or an Android mail app on iCloud, with printers and scanners that send by email, with backup tools and with services that sort your inbox.
At iCloud, it's the only way other apps can get in over IMAP. At Yahoo, AOL and Fastmail, you need one in any app without the provider's sign-in button.
Are they safe?
Safer than giving an app your real password: the code can't change your account, and you can revoke it on its own. Still, it has two weak spots worth knowing:
- It skips two-step verification. Whoever has the code gets into your mail without confirming anything on your phone. Treat it like a password: don't write it down or share it.
- It opens the whole mailbox. The app can read all your mail, and almost always send too. Fastmail is the exception: you choose what each one can reach when you create it.
So only give it to apps you trust, and delete the ones you no longer use.
Which providers have them
Checked on 26 October 2026 against each provider's help pages.
| Provider | What it's called | Requires two-step verification | Deleted when you change your password | Works for IMAP |
|---|---|---|---|---|
| Gmail and Google Workspace | App password | Yes | Yes | Yes |
| iCloud | App-specific password | Yes | Yes | Yes |
| Yahoo and AOL | App password | No | No | Yes |
| Fastmail | App password | No | ? | Yes |
| Outlook.com and Hotmail | App password | Yes | ? | No |
| Microsoft 365 | App password | Yes | ? | No |
? = the provider doesn't document it. Yahoo and AOL don't ask for a second step, but they do require a browser you've used for a few days. Fastmail's Basic plan has no IMAP and no app passwords.
Each provider's guide
Each guide has the steps, what to type in the app and what to do when it fails.
- Gmail app password. You need two-step verification. If Google won't show the option or says it "is not available", the guide explains why and how to fix it.
- iCloud app password. You need two-factor authentication. The catch is the username: it's your iCloud Mail address, not always the email you sign in to Apple with.
- Yahoo app password. It lives under External connections. If Yahoo won't let you create one, the browser is usually the problem. AOL works the same way.
- Fastmail app password. You choose what each code can access. The Basic plan has no IMAP. Thunderbird 115 or later doesn't need one.
- Outlook app password. Microsoft still lets you create one, but its IMAP server rejects it. The guide explains what works today.
- IMAP settings. Server, port and whether you need an app password at each provider, including GMX, IONOS, Zoho and custom domains.
Connecting a mailbox to MailTag
MailTag sorts each new email into your own categories (labels in Gmail; folders or marks elsewhere), and it signs in to your mailbox with an app password. Type your address under Settings → Mailboxes → Connect mailbox. It recognizes Gmail, Google Workspace, iCloud, Yahoo and Fastmail, also on your own domain. Then it shows that provider's steps, with a button that opens the right page. For any other provider you paste the code and the IMAP server.
Outlook, Hotmail and Microsoft 365 can't be connected yet, because they don't accept app passwords. MailTag keeps the code encrypted and loses access as soon as you delete it at your provider.
FAQ
Is an app password the same as my email password?
No. It's a separate code for one app. Your main password doesn't change and the app never sees it.
Why doesn't my correct password work in the app?
Because Gmail, iCloud, Yahoo and others no longer accept your normal password in third-party apps. It isn't wrong: they ask for an app password instead.
Do app passwords expire?
Not on a timer. Google and Apple delete them when you change your main password. Yahoo and AOL keep them until you delete them; Fastmail doesn't say.
How do I create an app password?
On your provider's website, never in the app. Gmail: myaccount.google.com/apppasswords. iCloud: account.apple.com → Sign-In and Security → App-Specific Passwords. Yahoo: Account security → External connections. Fastmail: Settings → Privacy & Security → Manage app passwords and access. The guides above have the full steps.
Can I see an app password again after creating it?
No, no provider shows it twice. Delete it and create a new one.
Is it safe to give an app password to a third-party app?
Safer than your real password, but the app can read all your mail. Only give it to apps you trust.
Do I need a separate app password for each app?
It's the recommended way. If an app stops being trustworthy or you lose a device, you delete only its code. Fastmail also asks you to choose each one's access.