How to Generate an iCloud App-Specific Password for Email Apps

Adding your iCloud email to a program like Outlook, Thunderbird, or a mail app on an Android phone should be simple. Then the setup asks for your password, you type the one you use for your Apple Account, and it is refused, again and again.

Apple is not broken, and neither is your memory. For third-party email apps, Apple requires a different credential called an app-specific password. It is a generated code that stands in for your real password in that one app. This guide shows you how to create one, where to use it, and how to manage the list as your devices change.

Quick Answer

Sign in at appleid.apple.com, open Sign-In and Security, and choose App-Specific Passwords. Click the option to generate a password, give it a clear label such as Outlook on Windows, and Apple will show a one-time code. Copy that code and paste it into your email app in place of your normal Apple password. The code is shown only once, so save it before closing the window.

What Is an iCloud App-Specific Password?

An app-specific password is a long, randomly generated code that Apple creates for a single app or service. The app uses it to reach your iCloud Mail, and depending on the service, sometimes your contacts and calendars too.

Your real Apple Account password never leaves your hands. Apple support pages describe this system in the official guide to using app-specific passwords, and the key benefit is control: every app gets its own code, and you can cancel any single code without signing yourself out everywhere else.

There is a limit to know about. Apple allows up to twenty-five active app-specific passwords on one account. That sounds like a lot, but a code for every app on every device adds up over the years, which is why tidying the list matters.

When You Need One

• Setting up iCloud Mail in Outlook, Thunderbird, or another non-Apple mail app.
• Adding iCloud email to an Android phone or a Windows PC.
• Connecting a scanner, backup tool, or home device that sends mail through iCloud.
• Any setup where your normal Apple password is rejected even though it is correct.

You do not need one for Apple’s own Mail apps on iPhone, iPad, or Mac when you are signed in to iCloud on the device. Those apps use your device sign-in directly, which is why iCloud Mail often just works there.

The One Requirement: Two-Factor Authentication

App-specific passwords only exist on accounts protected by two-factor authentication. Most Apple Accounts already have it, because Apple has required it for new accounts for years. If yours does not, turn it on first from your iPhone under Settings, your name, then Sign-In and Security.

Two-factor authentication means a thief who learns your password still cannot get in without one of your trusted devices. The app-specific password system builds on that foundation: the main account stays locked down, while approved apps receive narrow, revocable access.

How to Generate the Password, Step by Step

1. Open a browser on any computer or phone and go to appleid.apple.com.
2. Sign in with your Apple Account email and password, and approve the two-factor authentication prompt on a trusted device.
3. Choose Sign-In and Security from the account page.
4. Select App-Specific Passwords.
5. Click Generate an app-specific password, or the plus button if you already have some.
6. Type a label that names the app and device, for example Thunderbird on home PC.
7. Click Create, then confirm with your account password if Apple asks.
8. Copy the generated code exactly as shown, including the hyphens is fine, though most apps accept it either way.
9. Click Done once the code is safely saved or already pasted into the app.

Apple also presents these steps on the Apple ID account website itself, and the screens are the same whether you start there on a Mac, a Windows PC, or a phone browser.

How to Use the Code in Your Email App

Generating the code is only half the job. The other half is entering the right server settings alongside it, because most third-party apps set up iCloud Mail manually.

1. In your mail app, start adding a new account and choose the manual or IMAP option.
2. For the incoming server, enter imap.mail.me.com, port 993, with SSL enabled.
3. For the outgoing server, enter smtp.mail.me.com, port 587, with STARTTLS and authentication enabled.
4. For the username on both servers, enter only the part of your iCloud address before the @ sign. For example, if your address is jane.doe@icloud.com, the username is jane.doe.
5. For the password on both servers, paste the app-specific password, not your Apple Account password.
6. Save the account and let the app test the settings and download your folders.

That username detail catches many people out. Using the full email address as the username is correct for Gmail and Outlook accounts, but iCloud’s servers expect the short form, and the setup quietly fails until you fix it.

The app password works for mail only in most third-party apps. If you also want calendars and contacts from iCloud on a non-Apple device, check whether that app supports a separate iCloud sign-in, since settings vary widely.

Where This Fits With iCloud Mail

Once your mail app is connected, it behaves like any other account: messages sync through IMAP, and anything you delete or file on one device updates everywhere. The app-specific password simply keeps the door open.

If you run your own domain through iCloud, there is more to configure on the domain side. Our companion guide about setting up an iCloud custom email domain walks through the DNS records and the spam checks that go with it.

How to View and Revoke Passwords

Every code you create is listed at appleid.apple.com under Sign-In and Security, then App-Specific Passwords. You can see the labels and creation dates, though Apple never shows the codes themselves again.

To revoke one, click the minus button beside its label, or choose Revoke All to cancel every app-specific password at once. Revoking is the right move when you sell a computer, lose a phone, or stop using an app. Any program using a cancelled code will ask for a password the next time it tries to sync, and you simply generate a fresh code for the apps you still trust.

Changing your main Apple Account password also revokes all app-specific passwords automatically. Expect to recreate them for your third-party apps after any password change.

Troubleshooting When the Code Is Rejected

If the app refuses the code, first paste it again and watch for stray spaces copied at either end. Then confirm the username is the short form without the domain, and that the servers and ports match the settings above.

Check that the code is still active on the Apple ID website; a password change or a Revoke All in the past would have cancelled it. Finally, make sure two-factor authentication is still on, and that you are generating the code on the same Apple Account that owns the email address you are adding.

Common Mistakes to Avoid

• Trying your normal Apple password in third-party apps. Apple blocks it by design. The app-specific password is the intended route.
• Using the full email address as the username. iCloud IMAP expects only the part before the @ sign.
• Closing the window before saving the code. It is displayed once. If you lose it, delete the entry and create a new one.
• Using vague labels like test or app1. Clear labels make it easy to revoke the right code later without guesswork.
• Sharing one code between several apps. Give each app its own code so you can cancel access one app at a time.
• Forgetting the twenty-five code limit. If Generate is greyed out, you have hit the limit; revoke old codes first.

Conclusion

An iCloud app-specific password is Apple’s safe bridge between your account and third-party email apps. Turn on two-factor authentication, generate a clearly labelled code at appleid.apple.com, and enter it with the correct iCloud server settings and the short username form. Manage the list as devices come and go, revoke anything you no longer use, and your real Apple password never has to be typed into another company’s app again.

Frequently Asked Questions

Why does my normal Apple password not work in Outlook?

Apple requires app-specific passwords for third-party apps as a security rule. Your normal password is reserved for Apple sign-ins. Generate a code at appleid.apple.com and use that in Outlook instead.

Can I see an app-specific password again after creating it?

No. Apple shows each code only once at creation. If you lose one, revoke that entry and generate a replacement; it takes under a minute.

How many app-specific passwords can I have?

Up to twenty-five can be active at the same time. If you reach the limit, revoke codes for apps and devices you no longer use, then create the new one.

Does revoking a password delete any email?

No. Revoking only stops that app from signing in. Your mailbox is unchanged, and Apple apps signed in with iCloud keep working as normal.

Do I need a new code after changing my Apple password?

Yes. Changing your main password revokes all app-specific passwords automatically, so each third-party app will need a fresh code before it can sync again.