Why "App Passwords" Exist and When You Need One
I've lost count of how many times someone's told me, "I know my password is right, and it still says it's wrong." Nine times out of ten, when it's Outlook, Thunderbird, or a phone's mail app suddenly refusing to log in, the actual culprit isn't the password at all — it's two-factor authentication quietly changing the rules underneath them.
What's actually happening
Once you turn on 2FA for Gmail, Yahoo, or Outlook.com, your regular password alone stops being enough anywhere — you're supposed to also approve a prompt or enter a code. The problem is that a lot of older mail apps and desktop clients have no way to show that second prompt. So instead, providers give you a separate, single-purpose app password to hand to that one app.
How to generate one
- Sign in to your provider's account security settings in a browser.
- Look for "App passwords" (sometimes tucked under "2-Step Verification" or "Security").
- Generate a new one, name it something you'll recognize later ("Outlook desktop," "iPhone Mail"), and copy it.
- Paste it into the app in place of your normal password.
Is it safe?
Genuinely, yes — more so than using your main password everywhere, honestly. You can revoke one app's access without touching your main password or any other device it's used on.