App Password Not Working: How to Fix It
Put every mailbox on one board and let AI categorize and de-spam each message.
An app password usually fails for one of four reasons: two-step verification is not fully switched on, the account is a work or school account where an administrator has blocked app passwords, you are typing the password into a client that expects a modern sign-in window, or the provider has retired password-based sign-in for that protocol entirely. The last one is new and it catches people out, because nothing about the error message tells you the password was correct and the door was simply closed. Here is how to tell the four apart, provider by provider.
Why is my app password not working?
Work through these in order. The first two account for most failures, and both are fixable in under a minute.
| Cause | What you will see | Fix |
|---|---|---|
| Two-step verification is off, or half set up | The app password option is missing entirely, or a freshly created code is rejected | Turn on two-step verification on the account, confirm it with a real sign-in, then generate the password again |
| You pasted the password with the spaces | Generic "wrong password" error, usually on Gmail and iCloud | Type the 16 characters with no spaces. The grouping is only there to make it readable |
| An admin has blocked it | The setting is missing on a work or school account | Ask whoever runs the domain. On many business tenants this is off by policy and cannot be self-served |
| The protocol no longer accepts passwords | Correct password, immediate authentication failure, often on Microsoft 365 | Nothing you can type will fix it. The client needs to support modern sign-in |
| Wrong port or encryption | Timeouts, or "could not connect" rather than "wrong password" | Check the server settings before blaming the password. A connection error is not an auth error |
That last distinction saves a lot of wasted time. If the client says it cannot reach the server, the password is not the problem. If it reaches the server and gets refused, then it is an authentication problem and the list above applies.
What does "the setting you are looking for is not available for your account" mean?
Google shows this message when your account is not eligible to create app passwords at all, which is why generating a new one never helps. Google lists three situations that cause it: your account uses security keys as its only second step, you are signed in to a work, school, or other organization account, or the account is enrolled in Google's Advanced Protection Program. In all three, app passwords are switched off deliberately.
There is a fourth case that Google does not phrase as an error: two-step verification is not on yet. App passwords only appear once two-step verification is active, so if you have never set it up, the option simply is not there. Turn it on, sign out and back in once, then look again under your Google Account security settings. Note that the setting lives in your Google Account, not in Gmail, which is where most people go looking first.
If you are on a Workspace account and the option is missing, that is your administrator's policy, not a bug. They can re-enable it for the domain, though many will not, because Google's stated preference is that apps use its OAuth sign-in instead.
Why is my Gmail app password not working for SMTP?
Gmail app passwords do still work for IMAP and SMTP, so if a correct one is being refused, check these four things. Use the full address as the username, not just the part before the @. Use smtp.gmail.com on port 587 with STARTTLS, or port 465 with SSL. Enter the 16 characters with no spaces. And make sure you generated the password on the same account you are connecting, which sounds obvious until you have three Google accounts signed in to the same browser and the settings page quietly opens on the wrong one.
One more thing trips up people wiring a mailbox into a sending tool: Google applies sending limits per account, and hitting them produces authentication-looking errors that have nothing to do with the password. If you are connecting a mailbox in order to run outreach at volume, that is worth understanding before you blame the credentials, and it is generally a job for a platform built for sending sequences rather than a raw SMTP connection from a script.
Why do app passwords no longer work with Microsoft 365?
Because Microsoft turned them off. App passwords depend on basic authentication, and Microsoft has spent years retiring basic auth in Exchange Online. The final piece, client submission over SMTP AUTH, began being rejected in March 2026 and enforcement completed by the end of April 2026. After that point, a Microsoft 365 work or school mailbox will refuse a correct app password on SMTP, and IMAP and POP went the same way earlier in the deprecation.
This is the failure mode with no workaround. You cannot regenerate your way out of it, and neither can your administrator flip a switch to bring it back, because the change is on Microsoft's side rather than the tenant's. The only fix is to connect with a client that supports OAuth 2.0, the modern sign-in flow where you approve access in a Microsoft window instead of typing a password into the app. Most actively maintained mail clients added support for this years ago; anything that has not been updated since will simply stop working with Microsoft 365.
Personal Outlook.com and Hotmail accounts are a separate track from business Microsoft 365 tenants, and app passwords there still hang off having two-step verification enabled. Given the direction of travel, though, it is worth assuming that any Microsoft mailbox will eventually want OAuth rather than a typed password.
Why is my Yahoo app password not working?
Yahoo generates app passwords from the Account Security page, and the two common failures are mundane. The first is that the password was created for a different Yahoo address than the one you are connecting, which happens easily with aliases. The second is that Yahoo has invalidated existing app passwords after a password change or a security event, and old codes stop working silently. Delete the old entry, generate a fresh one, and connect using imap.mail.yahoo.com on port 993 with SSL.
Why does my iCloud app-specific password keep failing?
Apple calls them app-specific passwords and requires two-factor authentication on the Apple Account before the option appears. Two details cause most of the failures. Apple revokes every app-specific password you have created whenever you change your Apple Account password, so a working setup can break the day after an unrelated password reset, and you have to regenerate each one. Apple also caps how many can be active at once, so if you have been generating them for years, delete the ones you no longer recognize before creating another.
Generate them at account.apple.com under Sign-In and Security, use your full iCloud address as the username, and connect to imap.mail.me.com on port 993 with SSL. Custom domains attached to iCloud Mail use the same credentials as the underlying account.
How do I tell whether the password or the server settings are wrong?
Read the error rather than the symptom. Authentication failures name the credentials: "invalid credentials," "username and password not accepted," "authentication failed." Connection failures name the network: "could not connect," "connection timed out," "server not found." A timeout means the client never got far enough to try your password, so the fault is the host, the port, or the encryption setting, and generating a new app password will change nothing. Fix the connection first, then judge the credentials.
If both look correct and it still fails, try the same credentials in a second client. If they work there, the problem is the first app rather than the mailbox. If they fail in both, it is the account, and you are back to the eligibility rules above.
Where this fits if you run several mailboxes
App passwords get genuinely annoying at scale. Each mailbox needs its own, each provider hides the setting somewhere different, and any password reset can invalidate a batch of them at once. If you are setting up four or five accounts, generate them one at a time and connect each mailbox before moving to the next, so a failure tells you exactly which credential is wrong. It is worth understanding what an app password actually is before you create a pile of them, and worth being deliberate about which apps you hand mailbox access to in the first place.
The reason people go through this at all is usually that they are tired of signing in and out of separate inboxes. That is what a unified inbox is for: connect each mailbox once over IMAP and read everything on one board instead of four. Inboxes connects with IMAP credentials, which means Gmail, iCloud, Yahoo, and your own domain work with an app password, while Microsoft 365 work accounts are subject to the modern-authentication requirement described above. If you are consolidating, the practical guide to doing it across providers is combining email accounts into one inbox.