You are trying to add your iCloud Mail to a mail app that is not made by Apple, and the app keeps rejecting your normal Apple Account password. That is expected. Third-party mail clients and manual IMAP setups cannot use your regular password once two-factor authentication is on your account.
The answer is an app-specific password: a one-off, 16-character credential you generate for that single app. You create it once on Apple's website, paste it into the app instead of your usual password, and the app can sign in to your iCloud Mail.
This guide walks you through generating one, entering it correctly, plugging in the exact iCloud server settings, and managing or revoking passwords later. The steps are ordered quickest and most common first.
Confirm Two-Factor Authentication Is On
This is the one prerequisite you cannot skip. Apple states it plainly: to generate and use app-specific passwords, your Apple Account must be protected with two-factor authentication.
The practical tell is simple. If the "App-Specific Passwords" option does not appear on Apple's site at all, two-factor authentication is almost certainly not enabled. Turn on two-factor authentication first; do not keep hunting the page for an option that will not show up without it.
Check Whether You Even Need an App-Specific Password
Some third-party apps support signing in to your Apple Account directly, which skips app-specific passwords entirely. In a supported app you enter your Apple Account email address, and when prompted you click Allow to authorize the app to access your data, then return to the app.
Apple does not publish a list of which apps support this flow; it refers only to "supported third-party apps." So the rule of thumb is: if the app offers a sign-in prompt that asks you to Allow access, use it. Apple's own fallback note covers the rest: if an app does not support direct authorization, you can sign in using an app-specific password instead.
One housekeeping point. If you later switch an app from an app-specific password over to the direct "Allow" flow, Apple recommends revoking the now-unused app-specific password to reduce the number of credentials in circulation.
Generate the Password at account.apple.com
This is the core task, and it lives entirely on Apple's website.
- 1.Go to account.apple.com and sign in to your Apple Account. (This is Apple's current domain; the legacy appleid.apple.com still redirects here.)
- 2.Locate the "Sign-In and Security" section.
- 3.Select "App-Specific Passwords".
- 4.Select "Generate an app-specific password".
- 5.Follow the on-screen instructions to finish generating it.
The generated password appears as four groups of four lowercase characters separated by hyphens, in the pattern xxxx-xxxx-xxxx-xxxx. Apple's instruction for using it is to enter or paste the app-specific password into the password field of the app when signing in. You can hold up to 25 active app-specific passwords at one time; if you hit that ceiling, revoke one before generating another.
Enter the Password Exactly as Generated
When you paste the password into your mail app, enter it exactly as generated, including the dashes. The value is four groups of four lowercase characters, and the standard guidance is to keep the hyphens in place rather than stripping them.
The single most common mistake here is using the wrong password. Use the app-specific password, not your Apple ID password, in the mail client. Entering your normal Apple ID password typically fails with an authentication error in a third-party client.
If sign-in still fails after you have confirmed you are using the app-specific password, you can try re-entering the 16 characters without the dashes as a fallback. Keep the dashes by default, though; dash removal is only a last resort if the app refuses the standard format.
Plug In the iCloud Mail Server Settings
If your app does not auto-detect iCloud and asks for manual IMAP and SMTP details, use the exact values below. Watch the username field carefully, because the incoming and outgoing servers expect different formats.
- Incoming (IMAP) server: imap.mail.me.com
- Incoming port: 993, with SSL Required set to Yes
- Incoming username: usually the short form of your iCloud Mail address (for example, johnappleseed, not johnappleseed@icloud.com)
- Incoming password: your app-specific password
- Outgoing (SMTP) server: smtp.mail.me.com
- Outgoing port: 587, with SSL Required set to Yes and SMTP Authentication Required set to Yes
- Outgoing username: your full iCloud Mail address (for example, johnappleseed@icloud.com, not johnappleseed)
- Outgoing password: the same app-specific password you used for incoming
Two gotchas save most troubleshooting time here. First, the username format differs between servers: incoming uses the short name while outgoing uses the full address, and mixing these up is a common cause of send or receive failures. Second, if you see an error message while using SSL, Apple advises trying TLS instead on the incoming server, and TLS or STARTTLS on the outgoing server.
Add the Account on iPhone or iPad
On iOS, the app-specific password path is the manual "Other" account flow, not the built-in iCloud tile. Choosing the iCloud provider tile uses your normal Apple ID sign-in and two-factor authentication instead.
- 1.Open Settings, then tap Apps.
- 2.Tap Mail, then tap Mail Accounts.
- 3.Tap Add Account.
- 4.Tap "Add Other Account", then tap "Mail Account".
- 5.Enter your name, your iCloud email address, the app-specific password in the Password field, and a description.
- 6.Tap Next. If Mail cannot auto-detect the settings, select IMAP (or POP) and enter the incoming and outgoing server details from the section above.
- 7.Tap Save or Done to finish.
Add the Account on Mac
The same split applies on a Mac: the native iCloud option uses your regular Apple ID and two-factor authentication, so the app-specific password is only for a generic IMAP setup.
- 1.Open System Settings, then click Internet Accounts.
- 2.Click Add Account and choose a provider. Selecting the iCloud tile uses your normal Apple ID, so no app-specific password is needed for that route.
- 3.To set iCloud Mail up as a generic IMAP account in Mail or a third-party client, add it as an "Other" or IMAP account.
- 4.Supply the app-specific password plus the imap.mail.me.com and smtp.mail.me.com server settings listed above.
Apple's own framing is worth repeating: app-specific passwords are only needed for third-party email clients. Adding iCloud through the native iCloud option uses your regular Apple ID.
Revoke or Manage a Password Later
App-specific passwords are disposable by design, and you manage them from the same place you created them.
- 1.Sign in to account.apple.com.
- 2.Go to "Sign-In and Security", then "App-Specific Passwords".
- 3.Select the Remove button next to the password you want to revoke, or choose "Revoke All".
Two behaviors are worth knowing in advance. Revoking a password signs that app out of your account immediately, and the app stops syncing until you generate a new password and sign in again. Separately, any time you change or reset your primary Apple Account password, all of your app-specific passwords are revoked automatically to protect the security of your account; after that you must generate brand-new passwords for each affected app.
Frequently Asked Questions
Why is the "App-Specific Passwords" option missing on Apple's site?
Two-factor authentication is not enabled on the account. The option only appears once two-factor authentication protects your Apple Account, so enable that first rather than searching the page further.
Should I keep the dashes when I enter the password?
Yes. Enter or paste it exactly as generated, including the dashes, in the pattern xxxx-xxxx-xxxx-xxxx. Only if sign-in fails should you try the 16 characters without the dashes as a fallback.
Why does my mail send fail even though receiving works?
Most often the outgoing username is wrong. The incoming (IMAP) server expects the short name like johnappleseed, but the outgoing (SMTP) server expects the full address like johnappleseed@icloud.com. Also confirm the outgoing port is 587 with authentication required.
My app stopped syncing on its own. What happened?
If you recently changed or reset your main Apple Account password, all app-specific passwords are revoked automatically. Generate a new one and sign in again in the app to restore syncing.
What if I get an SSL error during setup?
If you see an error while using SSL, try TLS instead on the incoming server, and TLS or STARTTLS on the outgoing server. The hostnames and ports stay the same.
How many app-specific passwords can I have?
Up to 25 active passwords at one time. If you reach the limit, revoke one you no longer use before generating a new one.
Do I always need an app-specific password for iCloud Mail?
No. Apple's own apps and the built-in iCloud account option use your regular Apple ID with two-factor authentication. Some third-party apps also support direct authorization, where you enter your email and click Allow. App-specific passwords are for third-party clients and manual IMAP setups that do not support that flow.
