App Passwords
Separate passwords for every phone and mail program.
Why App Passwords
Mail programs and phones store whatever password you give them, often for years, on devices that get lost, sold, or backed up to someone else's cloud. An App Password is a separate credential made for one device. It cannot log into the webmail or change any setting, it can be limited to the services and network addresses that device needs, and deleting it cuts off that one device without touching anything else.
Connections from outside the service to IMAP, POP3 and SMTP require an App Password; your account password is for the webmail only. Open Settings → App Passwords.
Creating One
- Click Create App Password.
- Give it a Name that tells you which device it is ("iPhone Mail", "Thunderbird on the laptop").
- Tick the Services it may use: IMAP, POP3, SMTP. A phone that only reads mail does not need SMTP.
- Optionally set an Expires date, and optionally add IP Restrictions: one or more addresses or ranges (
203.0.113.0/24) the password may be used from. Add My IP fills in your current address. Leave it empty for a phone that roams between networks. - Click Save. The next screen shows the Username and Password once, with the server names. Copy them into your mail program now; the password is never shown again and cannot be recovered, only replaced.
The username is a random string too, not your account name, so a leaked App Password reveals nothing about which account it belongs to. Enter the username in your mail program's user field, your normal address in the email-address field, and the generated password in the password field. Server names and ports are under Connection Info and in Support.
Managing Them
The list shows each password's name, services, creation date, Last Used time, IP restrictions and status (Active, Inactive or Expired). Edit changes the name, services, expiry and IP rules; the password itself cannot be viewed or changed. Delete revokes it immediately; the device's next connection fails. Delete All revokes every device at once, which is the right first move if you think your account has been compromised.
A Last Used time you do not recognize is worth investigating. Setup guides for each platform are on the Support page.