App passwords: why you need one and where to get it

A webmail login can ask for a second factor: a code from an app, an SMS, a tap on your phone. IMAP cannot. The protocol has exactly one LOGIN command carrying a username and a password, and there is nowhere in it for a second step.

Providers all solved this the same way. The account password stopped being accepted over IMAP at all, and external clients get a separate one instead: an app password. It is a long random string that works only for mail protocols, cannot sign you in to the web interface, and can be revoked with one click without touching your real password.

That leads to a practical point worth keeping: handing a migration tool an app password is safer than handing it your account password. Even if it leaks, nobody can enter the account, change the password, or read your files.

The section has a different name everywhere, but it always lives in account security settings, never in mail settings. Providers move the exact wording around, so follow the meaning rather than a literal path.

Gmail shows the password as four groups of four characters. The spaces are presentation, not part of the secret: what you paste is sixteen characters with nothing between them. This is behind roughly every third authentication failure we see on Gmail migrations.

The password is shown exactly once. Losing it costs nothing — revoke the old one, issue a new one in half a minute, and the mailbox itself is untouched.

The username stays what it was: the full address. One exception is worth remembering — on Yandex, a mailbox on a custom domain often expects only the part before the at sign, and signing in with the full address fails exactly like a wrong password would.

Three reasons, most common first, and what to do about each.

Revoke it. An app password is issued for one job, and once the mail has moved and the counters match, neither you nor we need it any more.

Revoking happens in the same place it was issued and closes IMAP access immediately, leaving your account password and your browser sessions alone.