When setting up an email client on a new device, you enter the IMAP server, the port, your email address, and then you reach the “password” field. That’s when the uncertainty sets in: should you enter your email account password, a separately generated code, or something else? The answer depends on your provider and its authentication requirements. Here’s how to find the right IMAP password for your situation.
IMAP password and email password: not always the same
In most cases, the password requested when connecting via IMAP is the one you use to sign in to your webmail. Enter your email address and your usual password, and the email client can access your messages.
This simple approach no longer works once two-factor authentication is enabled. Providers such as Apple (iCloud Mail), Google (Gmail), and Microsoft (Outlook.com) then block standard password sign-ins from third-party apps. You’re left with an authentication error and no clear explanation, leading many users to think their password has changed.
To understand the IMAP password in this context, you need to distinguish between two mechanisms: your account password (the one you use for webmail) and an app-specific password generated in your provider’s security settings.
App-specific password: where to generate one for each provider
When two-factor authentication is enabled, the provider requires an app-specific password to allow an IMAP connection. This is a unique string, often made up of random characters, that you don’t choose yourself.
iCloud Mail (Apple)
Apple requires an app-specific password as soon as two-factor authentication is enabled on your Apple Account. You can generate one in your Apple Account settings, under “App-Specific Passwords.” The IMAP username is usually the part of your iCloud email address before the @ sign.
One thing to keep in mind: changing your main Apple Account password revokes all existing app-specific passwords. After changing your password, you’ll need to create a new one for each email client configured to use IMAP.
Gmail (Google)
Google has gradually restricted password-only access for third-party apps. If two-step verification is enabled, you can generate an app-specific password in your Google Account security settings. Without two-step verification, Google may also offer sign-in via OAuth, which means you don’t need to enter a password manually in the client.
Outlook.com and Microsoft accounts
Microsoft has rolled out OAuth support for several types of accounts, including Yahoo accounts connected through Outlook. The rollout to the Current Channel was completed on August 2, 2023. With OAuth, you sign in through an integrated browser window, and the email client never stores your password in plain text.
For manual configurations that don’t use OAuth, an app-specific password is still required if two-step verification is enabled on your Microsoft account.
IMAP settings to check before entering your password
A valid password may be rejected if the incoming server settings are incorrect. Before questioning the password, check three things:
- The IMAP server address: each provider has its own (imap.mail.me.com for iCloud, imap.gmail.com for Gmail, outlook.office365.com for Microsoft 365, for example).
- The connection port: most providers use port 993 with SSL/TLS encryption. An incorrect port causes a silent failure or timeout, not necessarily a password error.
- The username: depending on the provider, this may be your full email address or just the part before the @ sign. For iCloud, it’s often the local part of the address.
An incorrectly configured SMTP server can also make the issue harder to diagnose. The client may display a general authentication error even though the problem is only with the outgoing server. You can save time by testing incoming mail (IMAP) and outgoing mail (SMTP) separately.
What to do when your IMAP password stops working
A password that worked yesterday may be rejected today even if you haven’t changed anything. Several causes come up regularly.
The first, as mentioned above, is a change to your main account password. Apple automatically invalidates app-specific passwords when this happens. With Google and Microsoft, the behavior varies depending on whether you sign in via OAuth or with an app-specific password, but the result is often the same: you need to generate a new app-specific password after any password reset.
The second cause is an email client update. Microsoft has reported IMAP compatibility issues with the new Outlook for Windows, which is still in development. Some users found that their password was rejected after an update, even though nothing had changed on the server side. In this case, deleting the account configuration from the client and setting it up again often resolves the issue.
A third possibility is that the provider has disabled password-only access in favor of OAuth. If the email client doesn’t support OAuth, the connection will fail. Check whether an “app-specific password” option is available as a fallback.
- Check whether two-factor authentication was recently enabled or changed on the account
- Try signing in to webmail with the same password to isolate the issue
- Remove and then reconfigure the account in the email client
- Generate a new app-specific password if the old one no longer works
The IMAP password is nothing mysterious once you know where it comes from. For accounts without two-factor authentication, it’s your webmail password. For other accounts, it’s an app-specific password that you need to generate and renew after each change to your main password. Keeping these app-specific passwords in a dedicated password manager saves you from repeating the process every time you set up a new client.
