Apple App-Specific Password Guide

To create an Apple app-specific password, sign in at account.apple.com with an Apple Account that has two-factor authentication turned on, open Sign-In and Security → App-Specific Passwords, select the add (+) button, give the password a label, and copy the 16-character code that appears — Apple shows it once and never again. You paste that code, hyphens included, into the password field of the third-party app instead of your normal Apple Account password. App-specific passwords exist only for apps that cannot handle two-factor sign-in, and an Apple Account can hold up to 25 of them at a time.

What an app-specific password is — and what it isn’t

An app-specific password is a secondary credential that lets one third-party app reach your iCloud data, usually Mail, Contacts, and Calendars, without that app ever seeing or storing your main Apple Account password. Per Apple’s support documentation, the feature is available only on accounts protected by two-factor authentication; on accounts without it, the option does not appear at all.

The most common mistake is treating it as a general-purpose password. It is not. It will not sign you into iCloud.com, it will not activate an Apple device, and Apple’s own apps on iPhone, iPad, and Mac never ask for one. If an app offers “Sign in with Apple” or a native iCloud account type, use that instead — it is easier to manage and survives more account changes.

Creating one: the steps and why each matters

1. Confirm two-factor authentication is on. Sign in to account.apple.com and check under Sign-In and Security. Reason: without 2FA the App-Specific Passwords entry is absent, and no amount of refreshing will make it appear.
2. Go to the App-Specific Passwords page. It sits under Sign-In and Security, not under Devices. Reason: older guides point to appleid.apple.com, which now redirects; the setting itself moved with the Apple Account rename.
3. Select the add (+) button. You may be asked to enter your Apple Account password and a six-digit code sent to a trusted device. Reason: creating a credential that bypasses 2FA for one app is treated as a sensitive action.
4. Label it with device plus app. Something like “Thunderbird — Windows desktop” or “eM Client — work laptop.” Reason: labels are the only way to tell up to 25 near-identical entries apart when you audit the list a year later.
5. Copy the password before leaving the screen. Reason: Apple displays it once. If you lose it, there is no recovery path — you revoke the entry and generate a new one.
6. Paste it into the app’s password field, hyphens included. Reason: hyphens are part of the displayed format. If the app rejects it, try typing it without hyphens — a few clients strip them on paste.
7. Send and receive a test message. Reason: receiving exercises the incoming server, sending exercises the outgoing server, and they authenticate separately.

Putting it to work: a worked example

Say you want your iCloud Mail address working in a desktop client on Windows. Your Apple Account is [email protected], 2FA is on, and you have just generated the app-specific password abcd-efgh-ijkl-mnop labeled “Thunderbird — Windows desktop.” According to Apple’s iCloud Mail server settings, you would enter the following, using your full iCloud address as the username in both columns and the app-specific password as the password in both columns.

Calendar and contact syncing use the same credential but different endpoints — CalDAV at caldav.icloud.com and CardDAV at contacts.icloud.com, both over port 443. Note that iCloud Mail requires an @icloud.com, @me.com, or @mac.com address; an Apple Account tied to a third-party email address has no iCloud mailbox to connect to.

Which credential should you use? A quick decision table

Common sign-in failures and how to fix them

Almost every “app-specific password not working” report falls into one of a handful of buckets. Work down this list before generating a new credential — a fresh password rarely fixes a settings problem.

Revoking and managing app-specific passwords

Revoking is the same journey in reverse: sign in at account.apple.com, open Sign-In and Security → App-Specific Passwords, select the entry, and choose Revoke. The change takes effect at the app’s next authentication attempt — an app with an open, already-authenticated session may keep working until it reconnects or restarts, at which point it will be denied and prompt for a password.

Two ownership realities are worth planning for. First, the 25-password ceiling is a hard stop, and it is easy to hit if you create a new entry every time a client misbehaves instead of diagnosing the settings. Second, one generated password is not technically bound to one app — the label is a note to yourself, not a restriction, so the same credential will authenticate in several clients if you enter it there. That is convenient and also a security liability: revoking it kills access everywhere at once, and you lose the ability to tell which app is doing what. One label per app, revoked when the app is uninstalled, keeps the list honest.

If you ever turn off two-factor authentication on the account, every app-specific password is revoked at once, and each app will need to be set up again if and when 2FA is re-enabled. Treat the credential list as part of your account cleanup routine rather than something you configure once and forget.

Frequently Asked Questions

Do app-specific passwords expire?

No. They stay valid until you revoke them, until you turn off two-factor authentication (which revokes all of them), or until the app’s own account is removed. Apple does not retire them on a timer, so the practical expiry date is whenever you decide to clean up your list. After any change to your Apple Account password, test your third-party apps; if one fails, revoke its entry and generate a replacement.

How many app-specific passwords can I have?

Apple’s documented limit is 25 active passwords per Apple Account. Once you reach it, creation is blocked until you revoke at least one. Because labels are free text, the list becomes hard to interpret quickly — label each entry with the device and the app at the moment you create it, not later.

Can I use the same app-specific password in more than one app?

Yes, technically. The credential is not cryptographically tied to the label you gave it, so any app that accepts an app-specific password will accept the same one. Best practice is still one per app, because revoking a shared password cuts off every app using it at the same time and makes troubleshooting ambiguous.

Why won’t my app-specific password work on iCloud.com or my iPhone?

Because those sign-in screens don’t accept it by design. App-specific passwords are scoped to third-party apps that cannot present a two-factor prompt. On iCloud.com, in Apple’s Mail app, and during device setup, use your normal Apple Account password followed by the six-digit verification code sent to a trusted device.

What happens to the app when I revoke its password?

The app loses access at its next authentication. Depending on the client, that may mean a password prompt, a sync error, or a repeated “cannot verify account” message until you either re-add the credential or remove the account. Revoking does not delete any mail, calendar events, or contacts already stored on your device.

Do I need an app-specific password for Apple Mail on my Mac?

No. Apple’s own Mail, Contacts, and Calendar apps on iPhone, iPad, and Mac sign in with your Apple Account and handle two-factor authentication natively. App-specific passwords are for third-party clients — typically desktop email programs on Windows or Linux, or older apps that predate modern sign-in flows.