What Is an App Password? A Plain-English Guide

An app password is a sixteen-character credential a provider generates for you, on demand, when two-factor authentication is turned on for your account. You give that credential to a single application — a migration tool, an old desktop client, a backup script — instead of your real password. It exists because IMAP and SMTP predate two-factor auth, and most legacy mail clients have no way to handle the second factor. This entry covers what an app password is, how the three big providers issue them, and when an OAuth 2.0 connection is the better choice.

The short definition#

An app password is a separate, revocable password tied to one application. It bypasses the two-factor prompt for that one app only. Pasting it into anything else (a phishing form, the wrong tool, a colleague's machine) gives that thing full mailbox access until you revoke the credential.

The format is almost identical across providers: 16 lowercase letters, usually displayed as four groups of four separated by spaces. The spaces are decorative — paste with or without.

Gmail app password#

Google issues app passwords from the Security section of your Google Account, under App passwords. The page only appears if you have two-step verification turned on. You name the password (a hint for your own benefit, not Google's), and Google generates the 16-character string once. Copy it immediately — it is not shown again.

Use it as the password for IMAP (imap.gmail.com:993) or SMTP (smtp.gmail.com:587). If you see AUTHENTICATIONFAILED after pasting one, see fix Gmail app password — the most common cause is pasting the visible password from your Google login by mistake.

Yahoo app password#

Yahoo's flow is similar. Sign in, open Account Info, choose Account Security, and click Generate app password. Yahoo asks what the password is for (it is metadata only), then displays the 16-character string. Use it as the IMAP password against imap.mail.yahoo.com:993.

Yahoo is one of the few large providers that still strongly encourages app passwords for third-party IMAP access. For a Yahoo to Gmail migration, the source-side credential will almost always be an app password rather than OAuth.

Apple app-specific password#

Apple calls it an app-specific password. Generate one at appleid.apple.com under Sign-In and Security → App-Specific Passwords. Apple also limits each account to 25 active app-specific passwords. Use it as the password for imap.mail.me.com:993 and smtp.mail.me.com:587.

Apple app-specific passwords expire automatically when you change your Apple ID password — every one of them, all at once. Plan for that during a migration window.

When you need one, and when OAuth is better#

You need an app password whenever:

• Two-factor authentication is on (otherwise the provider just lets you use your real password).
• The tool or device only speaks plain IMAP or SMTP, with no built-in OAuth flow.
• You are connecting an older mail client, a backup utility, or a script that cannot open a browser.

You should prefer OAuth when:

• The provider supports it (Google, Microsoft, Fastmail, Zoho).
• The tool supports it (most migration tools released in the last three years do).
• You want scoped, revocable, audit-logged access rather than a credential with full read/write.

The practical rule of thumb: if the provider gives you both, use OAuth. If the provider gives you only one option, use that one. The credential exchange happens once at setup, and after that the tool is responsible for the connection.

Revoking an app password#

Every provider has a list of active app passwords on the same screen where you generated them. Revoking is one click. The next IMAP or SMTP authentication attempt with that credential fails with AUTHENTICATIONFAILED or Invalid credentials. This is what makes app passwords genuinely useful — you can give one to a migration tool, run the migration, then revoke it the same afternoon without touching your real password.