Email App Keeps Asking for Password: Why It Loops

When an email app keeps asking for your password, even after you type the right one, the cause is almost never the password itself. The app has a cached credential — an OAuth token, a keychain entry, or an app password — that has expired or been revoked. Instead of surfacing a clear error, it replays that dead credential against the mail server, the server rejects it, and the prompt reappears.

Typing the correct password into a broken prompt does nothing, because the stale cached credential is what the client actually sends. The fix requires one core step regardless of platform: locate the invalid entry and remove it so the app can run a genuine fresh authentication from scratch.

This guide covers the three most common causes — a revoked OAuth token, a stale OS-level cached entry, and an app password invalidated by a password change — with step-by-step fixes for each and a short diagnostic to identify which one applies to you.

What the password prompt loop actually means#

A modern email client does not send your password directly to the mail server on every sync. It either exchanges credentials for a short-lived OAuth token — the standard for Gmail and Microsoft 365 — or stores a password in the OS keychain or Credential Manager so it does not ask again. When that stored credential becomes invalid, the client has nothing valid to present.

The server responds with an authentication failure. The client interprets this as a missing credential and throws up the password prompt. You type the correct password, the client stores it but still presents the old stale credential to the server on the next sync attempt, and the cycle repeats. The prompt is a symptom of the broken cached entry, not of a wrong password.

Common causes at a glance#

The table below maps each cause to how to identify it and which fix to apply. Match your situation to a row, then skip to that fix.

Fix 1: remove the account and re-authenticate via OAuth#

If the prompt followed a password change, a 2FA change, or a provider security event, the OAuth token your client holds has been revoked. The only remedy is to remove the account entry so the old token is discarded, then re-add the account so the client receives a fresh one through a full OAuth sign-in.

This fix applies to Gmail accounts in any client and to Microsoft 365 or Outlook.com accounts in the Outlook desktop app or mobile apps.

1. 1

   Open your mail app's account settings

   In Outlook: File, then Account Settings, then Account Settings again. In Apple Mail: Mail menu, then Settings, then Accounts. In Thunderbird: Account Settings from the three-line menu. Locate the account that is showing the password prompt.

2. 2

   Remove the affected account entirely

   Select the account and click Remove or Delete. The client discards its stored credentials and cached token for that account. This does not delete server-side mail — messages stored on an IMAP or Exchange server remain there and will re-sync when you re-add the account.

3. 3

   Quit the mail application fully, then reopen it

   Closing the window is not enough. Quit the process so no residual token stays loaded in memory. Reopen the app before adding the account back.

4. 4

   Add the account again using the provider's OAuth sign-in

   Choose Gmail or Microsoft 365 as the account type, not manual IMAP or SMTP. The client will open a browser window where you sign in directly. This generates a new, valid OAuth token. Approve the permissions the client requests — read and send access — and the account appears without a password prompt.

Fix 2: remove the stale cached credential from the OS#

When the prompt appears on one device and webmail works fine, the problem is a stale or corrupted entry in the operating system's credential store. On macOS that is Keychain Access; on Windows it is Credential Manager. Deleting the entry forces the app to prompt once for a valid credential and then store it correctly.

1. 1

   macOS — open Keychain Access

   Press Command and Space to open Spotlight, type Keychain Access, and press Return. Alternatively find it in Applications, then Utilities.

2. 2

   macOS — search for and delete entries tied to your account

   In the search bar, type your email address or the mail server hostname such as imap.gmail.com or outlook.office365.com. Look for items labeled Mail or Internet Password that reference your address. Double-click each to confirm it is the right account, then close the detail window and press Delete. Remove all matching entries.

3. 3

   Windows — open Credential Manager

   Open the Start menu, type Credential Manager, and select it. Click the Windows Credentials tab. Look for entries referencing your mail server hostname, MicrosoftOffice, or your provider's name.

4. 4

   Windows — remove the stale entry

   Click the arrow to expand each matching entry, then click Remove. If multiple entries reference the same account or server, remove them all.

5. 5

   Restart the mail client and sign in once

   Quit the mail app fully and reopen it. When the credential prompt appears this time, enter your credentials. The OS stores a fresh valid entry and the prompt does not return.

Fix 3: generate a new app password after a password change#

App passwords are separate, randomly generated passwords that let a client connect via IMAP or SMTP when 2FA is enabled on the main account. Changing your main password does not automatically update them — it invalidates them. The client keeps sending the old one, which the server rejects every time.

You need to generate a new app password from your provider's security settings and update the password stored in your mail client.

1. 1

   Gmail — navigate to App passwords

   Go to myaccount.google.com, click Security in the left panel, then click 2-Step Verification. At the bottom of that page, click App passwords. You must have 2-Step Verification active for this option to appear.

2. 2

   Gmail — create and copy the new password

   Enter a label such as the name of your mail client and click Create. Copy the 16-character password shown — it is displayed only once. Revoke the old app password from the same list.

3. 3

   Update the password in your mail client

   Open the account settings for that Gmail address in your mail app. Under IMAP or SMTP settings, replace the old password with the new 16-character app password. Save and allow the client to reconnect.

4. 4

   Microsoft personal accounts — find App passwords

   Go to account.microsoft.com, click Security, then Advanced security options, and look for App passwords. Create a new one and update the password in your mail client's IMAP or SMTP settings the same way.

5. 5

   Microsoft 365 business accounts — check with IT

   Managed Microsoft 365 tenants frequently disable basic auth and app passwords entirely, requiring OAuth instead. If you are on a corporate account and the prompt persists, the solution is Fix 1 — re-adding the account using modern auth — not generating an app password. Contact your IT admin to confirm which authentication methods are permitted.

How to tell which cause you have#

The clearest signal is what changed before the prompt appeared and where the prompt is showing up.

If you changed your main email password recently, the most likely cause is an invalidated app password for clients using IMAP or SMTP, or an expired OAuth token for Gmail and Microsoft 365 clients using modern auth. Start with Fix 3 if the client uses a plain IMAP password, or Fix 1 if it connects via OAuth.

If you added or changed your 2FA method, an existing OAuth token may have been revoked as a security measure. Fix 1 is the usual path.

If the prompt appears on one device only and webmail is working, the cause is a local credential store issue. Use Fix 2 for the affected device and leave other devices alone.

If nothing obvious changed and the loop just started appearing, keychain or Credential Manager corruption is the most common culprit. Fix 2 resolves it in the large majority of these cases.

If you are on a corporate Microsoft 365 account and the prompt appeared after a network or tenant change, your IT team may have rotated the OAuth policy or tightened authentication requirements. Fix 1 — removing and re-adding the account via modern auth — is the standard remedy, but confirm the allowed client list with IT first.

How to stop the loop from coming back#

Once you clear the stale credential and reconnect, three habits prevent a recurrence.

Use OAuth wherever the option exists. OAuth tokens refresh automatically on normal expiry, so the client stays authenticated through routine session changes without prompting you. The prompt only returns if the token is explicitly revoked — by a password change or a security event — which gives you a clear, specific trigger to act on rather than a mysterious loop.

When you change your main password, immediately update every IMAP or SMTP client that uses an app password for that account, and revoke the old app passwords from your provider's security settings so they cannot be replayed against the server.

After any provider security event — a password change, a 2FA change, or a suspicious-activity alert — assume all cached tokens may have been invalidated. Re-authenticate your mail clients proactively rather than waiting for the prompt to force you to do it.

The reason the credential loop is hard to break manually is that the invalid entry sits in the OS keychain or token store, not in the password field the app shows you. Clearing it from the source is the step that actually works. We build AI Emaily, an AI-native email client that uses OAuth for Gmail and Microsoft 365 connections and surfaces a clear re-authentication step the moment a token is revoked, rather than cycling silently through a broken prompt. If you want to see how it handles mailbox connection on your accounts, you can start a free trial.