Fastmail IMAP Settings and App Passwords for Third-Party Clients

If a desktop or mobile mail app is rejecting your Fastmail login, the cause is almost always the same thing: Fastmail does not accept your regular account password over IMAP, POP or SMTP. It wants a separate app password instead, and the client's error message rarely says so directly.

This covers the exact IMAP and SMTP settings, how to generate and scope an app password, what to do when a client still refuses the connection, and how to revoke a password you no longer trust.

Before you start#

You need three things: your full Fastmail email address (not just the username portion), a generated app password, and the server settings below. Your account's login password will not work in a third-party client — that's expected behavior, not a bug.

Fastmail requires SSL/TLS on every protocol. There is no insecure fallback, so a client set to "None" or "Auto" for encryption will fail the connection before it even gets to the password.

Fastmail's IMAP and SMTP settings#

Why Fastmail wants an app password, not your account password#

Your Fastmail account password is what unlocks the full account — including account settings, billing, and (if enabled) two-factor authentication. IMAP, POP and SMTP are older protocols that don't have a standard way to ask for a second factor mid-login, so a client using your real password would bypass two-factor entirely.

An app password sidesteps that: it's a separate credential scoped to specific protocols, tied to one named app or device, and revocable on its own without touching your main login. If a laptop with a mail client on it is ever lost, you disable that one app password instead of resetting your whole account password.

How to create a Fastmail app password#

1. 1

   Open Privacy & Security settings

   Log in to the Fastmail web app, then go to Settings → Privacy & Security.

2. 2

   Find app password management

   Under "Connected apps & API tokens," click "Manage app passwords and access."

3. 3

   Start a new app password

   Click "New app password." If prompted, re-enter your account password to confirm it's you.

4. 4

   Name it

   Pick a preset name matching your client (Apple Mail, Outlook, Thunderbird) or type a custom one — this is just a label so you can identify it later.

5. 5

   Choose the access scope

   Select "Mail, Contacts & Calendars" for a standard IMAP/SMTP mail client, or "Files (WebDAV)" if the app only needs Fastmail Files storage.

6. 6

   Generate and copy the password

   Click "Generate password." Fastmail shows it once — copy it immediately, since you can't view it again after leaving the page.

7. 7

   Paste it into your mail client

   Enter your full email address as the username and the generated app password as the password, alongside the IMAP/SMTP settings above.

Fastmail app password scopes, explained#

Fastmail keeps the scope choice simple rather than offering a long checklist of individual permissions. The two options you'll see when generating a password are:

• Mail, Contacts & Calendars — grants IMAP/POP/SMTP for mail, CardDAV for contacts, and CalDAV for calendars. This is the right choice for almost every third-party mail client, including ones that also sync contacts and calendar.
• Files (WebDAV) — grants access only to Fastmail's file storage over WebDAV. Use this for a file-sync app, not a mail client.

Platform differences#

The server settings are identical across platforms, but where each client asks for them — and how it labels the password field — varies.

CalDAV and CardDAV: syncing calendar and contacts#

The same app password that unlocks IMAP and SMTP also covers Fastmail's calendar and contacts sync, as long as you generated it with the Mail, Contacts & Calendars scope rather than the Files (WebDAV) scope. macOS, iOS, and most desktop calendar apps support CalDAV and CardDAV natively; Android's built-in Calendar and Contacts apps don't speak either protocol directly, so you'll need a third-party CalDAV/CardDAV sync app from the Play Store.

What to do when it doesn't work#

Most rejected logins in a third-party client trace back to one of a handful of causes. Work through these in order before assuming something is broken on Fastmail's end.

Revoking a Fastmail app password#

Fastmail doesn't offer a way to rename or edit an existing app password's scope — once it's created, the name and access level are fixed. To rotate a password you merely suspect is stale, rather than one you know is compromised, generate a new one with the same name and scope, update it in the client, confirm the client connects, and only then remove the old password.

1. 1

   Open the app passwords list

   Settings → Privacy & Security → Manage app passwords and access.

2. 2

   Select the password to remove

   Check the box next to the app password you want to revoke.

3. 3

   Disable or remove it

   Click "Disable" to pause access temporarily, or "Remove" to delete it permanently. A removed password can't be restored — generate a new one if you need access again.

A faster way to work with Fastmail#

Getting IMAP and SMTP wired up correctly is a one-time setup cost, but once your Fastmail inbox is connected in any client, the next problem is the same one every mail app has: triage. Nothing about a correctly configured IMAP connection sorts your mail, drafts replies, or flags what actually needs a response.

We build AI Emaily, an AI-native email client that connects to Fastmail over IMAP alongside Gmail and Outlook accounts, and adds a chief-of-staff layer on top — triage, draft-in-your-voice replies, and approve-before-send agent actions, with undo and an audit trail on anything it does. Connecting Fastmail works the same way described above; AI Emaily just asks for the app password once during setup rather than you configuring a separate client each time.

See how it connects at /docs/connect-fastmail, or start a 7-day free trial at /pricing.