How to Create a Yahoo App Password for a Third-Party Email App

How to create a Yahoo app password comes up the moment you try to add Yahoo Mail to Thunderbird, Outlook, or any other IMAP client and the connection fails with 'invalid credentials'. Yahoo's mail servers block authentication with your main Yahoo account password from third-party clients — it will never work, even if you type the password correctly. The solution is an app password: a separate, randomly generated credential that Yahoo issues specifically for this purpose.

The option lives under External connections in Yahoo Account Security, which is not where most people look first. The steps below walk through finding it, generating the password, and entering it in the most common clients. There is also a detail at the end worth knowing: unlike your main Yahoo password, app passwords survive a Yahoo password reset — a security property that cuts both ways.

Before you start#

Yahoo requires two-step verification to be active on your account before the External connections section appears in Account Security. If you have never turned it on, go to login.yahoo.com/account/security and enable it first. Yahoo supports phone number verification, an authenticator app, and a hardware security key. Once two-step verification shows as active, External connections appears below it on the same page.

IMAP access is on by default for personal Yahoo Mail accounts, so no separate toggle is needed. If you use Yahoo Mail Pro or a Yahoo Small Business mail account, the Account Security path is the same, but the surrounding interface may look different. AOL Mail accounts work identically — Yahoo owns AOL and the External connections section is the same system under the same name.

How to create a Yahoo app password: step by step#

The process takes about three minutes. Yahoo will ask you to complete a two-step verification challenge partway through, so have your phone or authenticator app within reach before you start.

1. 1

   Go to Account Security

   Navigate to login.yahoo.com/account/security. Yahoo may prompt you to verify your identity with a code sent to your phone or generated by your authenticator app before displaying the full settings page. Complete that challenge before continuing — it appears every time you visit this page, not only on the first visit.

2. 2

   Find External connections

   Scroll down the Account Security page. External connections appears below the two-step verification section and above the Recent activity log. It lists any app passwords you have already generated and contains the button for creating new ones. If the section is absent, two-step verification is not fully active — scroll back up and confirm it shows as On before continuing.

3. 3

   Click Generate app password

   Inside External connections, click Generate app password (on some accounts this reads Generate and manage app passwords). Yahoo shows a dropdown asking you to select the type of app. For any email client — Thunderbird, Outlook, Apple Mail, or similar — select Mail. The type selection is stored with the password label; selecting the wrong type does not prevent the password from working, but it makes the External connections list harder to manage.

4. 4

   Name the connection

   Enter a label that identifies exactly what you are connecting, such as 'Thunderbird — work laptop' or 'Outlook desktop — home'. Yahoo displays this label in the External connections list so you can find and revoke individual passwords later. The name has no effect on how the password works; it exists only for your reference.

5. 5

   Click Generate and copy the password immediately

   Yahoo generates a unique password and shows it on screen. Copy it before you leave the page — Yahoo does not display this password again. Paste it into a password manager, or write it down somewhere accessible before dismissing the dialog. The password is typically 16 characters with no spaces.

6. 6

   Enter the password in your email client

   Open your email client's account configuration. Set the IMAP server to imap.mail.yahoo.com, port 993, with SSL/TLS. Set the SMTP server to smtp.mail.yahoo.com, port 465 with SSL/TLS or port 587 with STARTTLS. Enter your full Yahoo email address as the username. In the password field, enter the app password you just generated — not your main Yahoo password. Save and run the client's connection test.

Which platforms and clients need a Yahoo app password?#

The short answer is: any client that connects to Yahoo over IMAP using a username and password form, rather than redirecting you to a Yahoo sign-in page in a browser. The table below covers the most common setups.

What to do when Yahoo rejects your password in Thunderbird or Outlook#

The most common cause of a failed connection is entering your main Yahoo account password instead of an app password. Yahoo's IMAP and SMTP servers reject the main password from third-party clients by design — the error reads 'invalid credentials' or 'authentication failed' regardless of whether the password itself is correct. If you have not generated an app password yet, do that first.

If you have an app password and Yahoo still rejects it, work through these causes before generating a fresh one:

• Two-step verification was disabled after the app password was created. Yahoo invalidates all existing app passwords immediately when two-step verification is turned off. Re-enable two-step verification, generate a new app password, and update the credential in the client.
• The password was copied with spaces or copied incompletely. Yahoo sometimes formats the generated password with spaces between character groups for readability. The actual credential contains no spaces. Delete the existing entry from External connections, generate a fresh password, and paste it directly from the screen without reformatting.
• The IMAP server address or port is wrong. Yahoo's IMAP server is imap.mail.yahoo.com on port 993 with SSL — not port 143 or any other value. If the server address is incorrect, Yahoo never receives the authentication attempt and the error looks identical to a wrong password.
• The app password was generated with the wrong service type. Yahoo lets you select Mail, Calendar, Contacts, or other services when generating an app password. A password generated for Calendar does not authenticate a Mail connection. Check the type shown in the External connections list — if it reads something other than Mail, revoke that password and generate a new one with Mail selected.
• Yahoo has flagged the account for unusual activity. If Yahoo detects a new connection from an unfamiliar location or device, it may block it until you review a security alert. Go to login.yahoo.com/account/security, check Recent activity, clear any pending alerts, and retry the connection.

A faster way to connect Yahoo Mail to an AI email client#

If you are generating a Yahoo app password to connect Yahoo Mail to a client that handles drafting, triage, or inbox automation, there is a shorter path. We build AI Emaily, an AI-native email client that connects to Yahoo Mail over IMAP with the server settings pre-filled — imap.mail.yahoo.com, the right ports, SSL configured — so the only thing you enter is your email address and the app password you just generated.

Once connected, AI Emaily handles triage and drafting across three autonomy levels: Manual (you send every reply yourself), Copilot (the AI drafts and you approve before anything leaves), and Autopilot (the AI sends within rules you define, with undo and a full audit log). Voice matching in drafts comes from a user-set Personal Context brain and per-contact profiles, not from reading your past sent mail. AI Emaily starts with a 7-day free trial on Pro or Autopilot plans. If the setup friction is the issue, the connection guide at /docs/connect-yahoo takes about two minutes.