What is an app password? Gmail, iCloud, Yahoo and other IMAP mail

What an app password is

An app password is a second password your email provider generates for one app. The app uses it to sign in to your mailbox over IMAP, the standard protocol mail apps have used for decades. Your real password never leaves you. You can revoke the app password on its own, any time, without touching anything else on your account.

The names differ. Google's is a 16-character code and needs 2-Step Verification turned on first. Apple calls them app-specific passwords. Yahoo and AOL put them under Account Security. Same idea everywhere.

What it can and can't do

Most setup guides skip this part. Whoever holds an app password can do anything a mail app can do over IMAP. That means reading every message, moving it and deleting it, and on most providers sending mail as you. Gmail, iCloud and Yahoo don't offer a read-only version.

So ask a different question of any app that wants one: what does it do with the password, and how fast can you cut it off?

What it can't do is just as useful. It's made for mail apps. Changing your main password or your recovery settings still takes your real password and your second sign-in step.

Where to create one

The exact menus move around, but as of October 2026 these are the paths. Give each password a name you'll recognize later (the app's name works), because that's how you'll find it again to revoke it.

1. Gmail: Turn on 2-Step Verification for your Google account (required for app passwords). Open Google's App passwords page and create one named “Siftbird”.
2. iCloud Mail: Sign in to your Apple Account and open Sign-In and Security → App-Specific Passwords. Create one named “Siftbird”.
3. Yahoo Mail: Open Yahoo Account Security and choose Generate app password. Name it “Siftbird” and copy the password.
4. AOL Mail: Open AOL Account Security and choose Generate app password. Name it “Siftbird” and copy the password.
5. Fastmail: In Fastmail, open Settings → Privacy & Security → App passwords (IMAP needs a paid plan). Create one with Mail (IMAP) access.
6. Zoho Mail: In Zoho Mail settings, make sure IMAP access is turned on. Create an app-specific password in Zoho Accounts → Security.
7. GMX: In GMX settings, turn on POP3 & IMAP access. Use your GMX password (or an app password if you set one).
8. Other (IMAP): Find your provider's IMAP server name (it usually looks like imap.yourdomain.com). Use an app password if your provider offers one.

Which providers don't work this way

Outlook, Hotmail and Microsoft 365 don't. Microsoft no longer allows password sign-in for IMAP on these accounts, so an app has to use Microsoft's own sign-in instead. Siftbird doesn't support that yet.

Proton Mail only allows IMAP through its Bridge app running on your own computer. A server-side app like Siftbird can't reach it.

How to revoke one

Go back to the page where you created it and delete it. The app loses access the next time it tries to connect. Nothing else on your account changes, and any other app passwords keep working.

It's worth a look once a year. Most people find at least one password for an app they stopped using.

How Siftbird uses yours

Siftbird connects with an app password, so it has the same broad access described above. We'd rather providers offered something narrower. Mostly they don't.

Here's what it does with that access. The password is stored encrypted (AES-256-GCM). To sort a new email, Siftbird reads its headers and the first few kilobytes of text, decides, and forgets them. It marks noise read, archives clutter and, at the default Safe setting, moves obvious junk to your Spam folder. It never sends mail and never permanently deletes anything. Per email it keeps four things: the action, a category, the sender's domain and the message ID, so you can undo it.

It works with Gmail, iCloud, Yahoo, AOL, Fastmail, Zoho, GMX and most other IMAP servers. $5/month or $45/year, with a 7-day free trial and no card. Revoke the password at your provider and it stops.