What is an IMAP password?
Definition
An IMAP password is the password an email app uses to sign in to your mailbox over IMAP, the protocol that syncs your messages with the app. Some providers, such as Google, now want an app password or "Sign in with Google" instead.
- Category
- Security
- Also called
- IMAP email password, app password for IMAP
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: support.google.com
Last verified against the official page:
IMAP is one way an email app, such as Outlook, Apple Mail or Thunderbird, reads and syncs the mail stored with your provider. To get in, the app needs credentials. That sign-in secret is what people call the IMAP password.
What it actually is depends on your provider. With some providers it's the same password you use on the website. With others you create a separate one just for the app. Google describes an app password as a 16-digit passcode that gives a less secure app or device permission to access your Google Account. It only works on accounts with 2-Step Verification turned on, and Google revokes your app passwords when you change your account password.
Google also says app passwords aren't recommended and are unnecessary in most cases. Gmail no longer supports third-party apps that ask you to share your Google username and password, because sharing credentials with third parties makes it easier for hackers to get into your account. The safer route is the "Sign in with Google" option, which connects the app without handing it your password.
A typical case: you set up an older email client, it keeps rejecting your password with "Username and password not accepted", and a forum post tells you to type an app password. That can work, but it leaves a long-lived key to your mailbox sitting in one app.
Why it matters
Your mailbox is the reset point for most of your other accounts. Anyone who holds a working IMAP or app password can read your mail without needing your main password or a second factor. If you lose a device that uses one, treat it as a live key.
IMAP password vs. account password
Your account password signs you in on the provider's website. An IMAP or app password is a credential for one app or device. Where a provider issues them separately, you can revoke one without changing the other.
How to protect yourself
- 1
Use "Sign in with Google" or the provider's own sign-in when it's offered
Google recommends this over app passwords. The app gets access without ever seeing your password.
- 2
Only create an app password if the app has no safer option
Google's guidance is not to create one unless the app or device doesn't offer "Sign in with Google". Turn on 2-Step Verification first, since app passwords need it.
- 3
Revoke app passwords you no longer use
If you lose a device or stop using an app, remove its app password in your Google Account's App Passwords page. Google also revokes them all when you change your account password.
- 4
Keep your email address out of marketing lists and people-search sites
A mailbox that's widely listed draws more phishing aimed at your login. Serus finds where your email address and phone number are listed and removes them.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is an IMAP password the same as my email password?
Sometimes. With some providers the app uses your normal password. Google uses either "Sign in with Google" or a separate 16-digit app password on accounts with 2-Step Verification.
Why does my email app say "Username and password not accepted"?
Google lists that error as a sign the app uses an outdated sign-in method. Its steps: update the app to the latest version, then remove the account and sign in again using "Sign in with Google". An app password is a last resort.
Do I need to turn IMAP on in Gmail?
Not any more for personal accounts. Google says that from January 2025 the Enable or Disable IMAP option isn't available and IMAP access is always on.
Sources
Something wrong or out of date? Tell us and we'll re-check it.