mailtag
Blog / Guides
iCloud app-specific password: create one for Mail
- Create it at account.apple.com, under App-Specific Passwords, and paste it into your mail app instead of your Apple Account password.
- You need two-factor authentication. The username is your iCloud Mail address, not the email you may use to sign in to Apple.
- You can have up to 25, and changing your Apple Account password revokes them all.
Apple's own apps sign in to iCloud Mail with your Apple Account. Everything else, from Thunderbird or Outlook on Windows to an Android mail app or a service that sorts your inbox, needs an app-specific password: a separate code for that one app. Your Apple Account password won't work there, even if it's correct.
Below: how to create one, which username to type (the part most guides skip), and the errors people run into.
What an app password is
It's a separate code your provider creates for one app: the app opens your mail with it and never sees your real password. For the full picture of why it exists, when you need one and what the risks are, see what are app passwords.
Before you start
- Two-factor authentication. Apple requires it to create and use app-specific passwords (Apple support). If you sign in on a new device and get a six-digit code on your iPhone, it's already on.
- An iCloud Mail address. The code opens iCloud Mail, so you need an address ending in @icloud.com (or an older @me.com or @mac.com). If you sign in to Apple with a Gmail or work address and never set up iCloud Mail, there's no iCloud mailbox to open.
Create the app-specific password
- Sign in at account.apple.com.
- In Sign-In and Security, choose App-Specific Passwords.
- Choose Generate an app-specific password (or +), type a name you'll recognize, such as the app's name, and confirm with your Apple Account password if asked.
- Apple shows a code in four groups of letters. Copy it now: you won't see it again.
- Paste it into the app where it asks for a password.
These are the steps in Apple's guide, checked on 26 October 2026.
Which username and server to use
This is where most "wrong password" errors come from. IMAP is how mail apps fetch your email, and SMTP is how they send it. Apple's server settings page says:
| Incoming (IMAP) | Outgoing (SMTP) | |
|---|---|---|
| Server | imap.mail.me.com | smtp.mail.me.com |
| Port | 993 | 587 |
| Security | SSL (try TLS if you get an SSL error) | SSL, or TLS/STARTTLS if SSL fails |
| Username | Your iCloud Mail name, e.g. johnappleseed; if that fails, the full address | Full iCloud address, e.g. johnappleseed@icloud.com |
| Password | The app-specific password | The same app-specific password |
iCloud Mail doesn't support POP.
Using your own domain with iCloud+? Apple's page doesn't mention custom domains. Sign in with your iCloud Mail name or @icloud.com address, not you@yourdomain.com. In apps like Thunderbird, you can then add your domain address as a sending identity.
When it doesn't work
There's no App-Specific Passwords option
Two-factor authentication is off for your Apple Account. Turn it on in Sign-In and Security, then come back.
The app says the password is wrong
- You typed your Apple Account password instead of the app-specific password.
- The username isn't your iCloud Mail address. If you sign in to Apple with another email, that email won't work here.
- Try the username without @icloud.com, or with it: Apple says either may be needed.
It worked, then stopped
You changed or reset your Apple Account password. Apple revokes every app-specific password when that happens. Generate a new one and paste it into each app.
You already have 25
You can have 25 active at once. Remove the ones for apps you no longer use.
Remove an app-specific password
Go back to Sign-In and Security → App-Specific Passwords and remove the one you don't need, or choose Revoke All. The app that used it is signed out (Apple support). Do this if you lose a device or stop using a service.
Connecting iCloud to MailTag
MailTag sorts each new iCloud email into your own categories and signs in with an app-specific password. Under Settings → Mailboxes → Connect mailbox, type your iCloud address. MailTag recognizes iCloud, also when iCloud handles your own domain's mail. It shows these steps, with an Open Apple Account button. Paste the code, click Test & connect. Once connected, it starts by labeling your 20 newest emails. If you use your own domain, it asks for your @icloud.com address as the username.
By default, less important mail moves into MailTag folders (- Newsletter, - Receipt…), which show up in Apple Mail on every device; you can change that later. It checks for new email every 5 minutes, never deletes anything, and keeps the code encrypted. More on the folders in Sort iCloud, Yahoo or Fastmail mail. If you want an AI agent to read or answer your iCloud mail, see iCloud Mail MCP servers.
FAQ
Do I need an app-specific password for the Mail app on my iPhone or Mac?
No. Apple's own apps sign in with your Apple Account. You need one only for apps and services made by others.
Is the app-specific password the same as my Apple ID password?
No. It's a separate code that only works for the app you give it to, and you can remove it without changing your Apple Account password.
Why did my app-specific password stop working?
Most often because the Apple Account password was changed or reset, which revokes all of them. Create a new one.
How many app-specific passwords can I have?
Up to 25 active at the same time.
What's the IMAP username for iCloud Mail?
Your iCloud Mail address, or just the name before @icloud.com. Not the Gmail or work address you may use to sign in to Apple.
Can I see an app-specific password again?
No. Apple shows it only once; generate a new one and remove the old one.