iCloud App-Specific Password and IMAP Settings

To create an app-specific password for iCloud, sign in at account.apple.com, open Sign-In & Security, select App-Specific Passwords, then Generate an app-specific password. Give it a label, select Create, and paste the password into your mail app’s password field. In the app, use imap.mail.me.com (port 993, SSL/TLS) and smtp.mail.me.com (port 587, STARTTLS), with your iCloud Mail address as the username. Your Apple Account (formerly Apple ID) needs two-factor authentication turned on first.

An app-specific password is a separate password that Apple generates for one app made by another developer, so the app can reach information like your iCloud mail, contacts, and calendars without ever seeing your Apple Account password. You can revoke it later without changing anything else. It’s also how CatchNone reads alias mail on an iCloud+ custom domain, read-only and badged with the alias each message reached, on iPhone, iPad, and Mac. Some apps no longer need one; the next section shows which. Labels and server values below match Apple’s support pages and account.apple.com as of September 25, 2026.

Do you need an app-specific password?

Only for apps that ask for a password directly. Apple now lets supported apps connect with your Apple Account instead: the app opens an Apple sign-in page, you use your normal password and code, and you select Allow.

Apple’s server-settings page says Outlook 2021 or later on Windows can be authorized with your Apple Account. If classic Outlook doesn’t open Apple’s sign-in page, use an app-specific password as Microsoft describes.

A quick test: if the app shows only its own password field, it wants an app-specific password. Gmail works differently; see our Gmail app password guide.

Before you start: two-factor authentication

Apple requires two-factor authentication both to create and to use app-specific passwords. It’s the default for most accounts. If yours doesn’t have it, turn it on in one of these places:

• iPhone or iPad: Settings → [your name] → Sign-In & Security → turn on two-factor authentication.
• Mac: System Settings → [your name] → Sign-In & Security → turn on two-factor authentication.
• Web: Sign in at account.apple.com and select Upgrade Account Security.

Without a second factor, account.apple.com shows Restricted Access and limits your settings to the Devices section; that’s the first thing to check when App-Specific Passwords is missing. Work or school (Managed) Apple Accounts may not offer app-specific passwords at all; ask your administrator.

How to create an app-specific password for iCloud

Apple documents only one place to do this: account.apple.com, in any browser, including Safari on iPhone.

1. Go to account.apple.com and sign in with your Apple Account password and verification code. Old links to appleid.apple.com still open.
2. Select Sign-In & Security. (Apple’s help page spells it “Sign-In and Security”.)
3. Select App-Specific Passwords.
4. Select Generate an app-specific password.
5. Type a label that names the app, such as “Thunderbird laptop”, then select Create. You may be asked to confirm your Apple Account password.
6. Copy the password that appears under Your app-specific password is: and paste it into the app’s password field. It’s case-sensitive, so paste it exactly as shown, dashes included. Microsoft says it’s usually 16 characters in dash-separated groups, like xxxx-xxxx-xxxx-xxxx.

Three habits save trouble later:

• Copy it straight into the app. The account.apple.com page shows the password only when you create it; afterward the list shows its label, not the password. If the app might ask again, keep a copy in your password manager.
• Make one per app. The label is the only thing you’ll recognize later, and revoking one password then signs out only that app.
• Clean up old ones. You can have up to 25 active app-specific passwords.

iCloud Mail IMAP and SMTP settings

These are Apple’s values from iCloud Mail server settings (updated February 2026). Apple’s example address is johnappleseed@icloud.com.

A few notes that decide whether the settings work:

• Port 993 is encrypted from the start; port 587 starts plain and upgrades with STARTTLS (RFC 8314). Thunderbird’s settings database uses exactly this pairing.
• Apple documents only port 587 for sending, not 465.
• There is no POP. iCloud Mail supports IMAP and SMTP only.
• @me.com and @mac.com addresses use the same servers and settings.

iCloud custom domain: which IMAP username to use

With iCloud+ you can add up to five custom domains, with up to three addresses on each. Apple’s guide to adding a custom domain requires a primary @icloud.com address first.

Custom-domain addresses don’t need their own login. Mail sent to you@example.com arrives in the same iCloud Mail inbox, so one set of credentials reaches all of it:

• IMAP username: the name part of your @icloud.com address, or the full @icloud.com address.
• SMTP username: the full @icloud.com address.
• Password: the same app-specific password.

Apple’s server settings name only the iCloud Mail address as the username. Its guide also says that once you add a custom-domain address to iCloud Mail, you can’t use it to sign in to your Apple Account. To send as you@example.com from a third-party app, add it as a sending address in the app; most apps call this an alias or identity, and Thunderbird calls it Manage Identities.

Setting up the domain itself, including catch-all delivery, is covered in our guide to iCloud+ custom email domains. If you’re still choosing a host, see the best email providers for a custom domain.

App-specific password not working? Causes and fixes

Start by working out which problem you have: it worked and then stopped, it never worked, or you can’t create one.

It worked, then stopped

1. You changed or reset your Apple Account password. Apple then revokes every app-specific password automatically. Create a new one for each app you still use.
2. It was revoked. Someone selected Remove next to it, or Revoke all, at account.apple.com.
3. The app switched to Apple Account sign-in. Microsoft announced in October 2025 that existing iCloud setups in the new Outlook apps would be asked to sign in again. Apple’s sign-in page takes your normal password and code, not an app-specific one. If new Outlook still asks for an app-specific password, Microsoft says to update and restart Outlook.
4. Your iCloud storage is full. Apple says in its iCloud Mail limits that you then can’t send or receive iCloud Mail, which can look like a login failure.
5. You hit a sending limit. As of September 2026, iCloud Mail allows 1,000 messages and 1,000 recipients a day, 500 recipients per message, and 20 MB per message, per the same limits page.
6. Apple has an outage. Check Apple’s System Status page.

It never worked

• Wrong username. Use your iCloud Mail address (@icloud.com, @me.com, or @mac.com), not a custom-domain address. If your Apple Account uses a Gmail or other address, that isn’t your iCloud Mail address either. IMAP takes the name part (or the full address); SMTP needs the full address.
• No iCloud Mail address yet. Without an @icloud.com address there’s no iCloud Mail inbox to connect to; create a primary iCloud Mail address first.
• Security mismatch. Use SSL/TLS on 993. On 587, choose STARTTLS if the app asks; Apple also suggests TLS if SSL gives an error.
• Typos. Paste the password rather than retyping it. It’s case-sensitive.
• Your normal Apple Account password. It won’t work in an app’s password field.

App-Specific Passwords is missing or won’t generate

• App-Specific Passwords is missing. Turn on two-factor authentication, or ask your administrator if it’s a work or school account.
• You see “Couldn’t Complete This Action”. This can appear when the browser signed you in automatically from your device. Choose Sign In with Password and sign in again with your password and code. If you see “Continue on one of your devices” instead, Apple Community users report that signing in by hand with your password and code, or trying another browser, gets past it.
• You already have 25. Revoke the ones you no longer use, then try again.

What an app can do with an app-specific password

Apple says the password lets an app reach “information like mail, contacts, and calendars that you store in iCloud.” It is not a read-only credential, and for mail it gives full access.

Over IMAP (RFC 9051), an app can read, flag, move, and delete your messages. Over SMTP, it can send mail as you. The password allows whatever the app is built to do. Deletions made through IMAP happen on the server too; our explainer on whether IMAP deletes email from the server covers how that syncs.

Advanced Data Protection doesn’t change this, because iCloud Mail isn’t end-to-end encrypted. Give these passwords only to apps you trust, and revoke each one when you stop using the app.

How to revoke an app-specific password

1. Sign in at account.apple.com.
2. Select Sign-In & Security, then App-Specific Passwords.
3. Select Remove next to the password you want to delete, then confirm with Revoke. To remove every password at once, select Revoke all and confirm.

The app is signed out until you create a new password and sign in again. Changing your Apple Account password revokes all of them too, but then every app needs a new one.

Apps connected with Apple Account sign-in, such as the new Outlook apps, aren’t on this list. Remove them under Sign-In & Security → Account Data Sharing → Remove access. If you move an app from an app-specific password to Apple Account sign-in, Apple says to revoke the old password afterward.

Using an iCloud app-specific password with CatchNone

With an iCloud+ custom domain, CatchNone gives every shop, newsletter, and account its own alias on that domain and shows that mail in its own app. Each message is badged with the alias it reached, so a leaked or sold address shows up, and remote images, including most tracking pixels, stay blocked until you load them. The app reads iCloud directly from your device, so that mail never passes through CatchNone’s servers. It’s receive-only by design and changes nothing in iCloud. The Free plan covers up to 10 aliases, and Lite and Premium have no limit.

It connects with exactly this kind of password in its Bring your own domain path. In the Add Mailbox form, set Connection type to IMAP and Mail server to imap.mail.me.com, put your @icloud.com name (or the full address) in Email or username, and paste a password labeled “CatchNone”. Keep Port 993 with Secure connection (TLS) on, and select Test connection, because Save doesn’t test. The password stays in that device’s Keychain and doesn’t sync; on a second device, paste it from your password manager or create another one.

The password allows full access; only the app is read-only. Each time you open CatchNone or ask it to check, it reads the newest 100 inbox messages from the last 30 days, ordinary iCloud mail included, and never Junk. It imports only messages whose To, Cc, or Bcc names an address on a domain assigned to that mailbox. New aliases arrive only if iCloud accepts them, usually after turning on Allow All Incoming Messages. Marking an alias as not in use is only a label: iCloud keeps delivering, so block an address in iCloud Mail.

CatchNone is available for iPhone, iPad, and Mac.

FAQ

Where can I find my app-specific password?

Only where you saved it yourself, such as a password manager. The account.apple.com page shows the password only when you create it; afterward the list identifies it by its label. If you’ve lost it, create a new one, put it in the app, and revoke the old one.

Do app-specific passwords expire?

Apple doesn’t list an expiry. They stop working when you revoke them, or when you change or reset your Apple Account password.

Can I create one on my iPhone?

Apple documents no Settings screen for it. Open account.apple.com in Safari on your iPhone and follow the same steps. If Safari shows “Couldn’t Complete This Action”, choose Sign In with Password and sign in with your password and code. Mail on the iPhone itself doesn’t need one.

Do I need an app-specific password for Outlook?

Not in the new Outlook for Windows, Outlook for Mac, or Outlook for iOS and Android: they open an Apple sign-in page for your normal password and code, then you select Allow. Classic Outlook for Windows still needs one for mail; Apple’s iCloud for Windows app can sync its calendars and contacts. If the Apple sign-in fails in new Outlook, Microsoft suggests trying again or choosing Advanced setup. An app-specific password goes only into Outlook’s own password field, never into Apple’s page.

Does the same password cover calendars and contacts?

Yes. Apple says it lets an app reach “information like mail, contacts, and calendars” in iCloud, so one password per app is enough even if the app syncs all three.

Can Gmail collect my iCloud mail?

Not on the web: Gmail’s web fetching uses POP, which iCloud Mail doesn’t support, but the Gmail mobile app can still add non-Google accounts. See reading iCloud custom domain mail in Gmail for the options.