The short version
Think of your real email password as the key to the whole house: mail, settings, recovery options, and every account that sends a reset link to that address. An app password is a separate key for one app. Your provider generates it, shows it to you once, and lets you delete it at any time from your account security page. Yahoo describes app passwords as randomly generated codes that let other email apps access your account when they do not use Yahoo's sign-in page. Deleting one does not change your real password.
Yahoo, AOL, Gmail and iCloud all offer them. Apple calls them app-specific passwords. Gmail and iCloud offer them only when two-step verification is on, which is a good thing: the account behind the app password is already better protected.
What an app password can and cannot do
- It lets a mail program sign in to your mailbox over IMAP, the standard way mail apps read folders and move messages.
- It is not the password you use on your provider's sign-in page, so whoever holds it does not have the one secret that controls your account.
- It can be revoked on its own. One app password per app means you can cut off one tool without touching the others. Yahoo notes that to invalidate an app password you must delete it.
- It keeps working on Yahoo even if you change your main password, according to Yahoo, so a cleanup in progress is not interrupted.
App password or sign in with Google?
Google says app passwords are not recommended in most cases and suggests Sign in with Google instead, and for a lot of apps that is the right call. For a mail cleanup tool the details matter. Sign in with Google hands the app a set of permissions you approve on a consent screen. Google describes the broadest Gmail permission as able to "read, compose, send, and permanently delete all your email from Gmail". Narrower permissions exist, such as one that sees only headers and labels, and the consent screen tells you which one a tool asks for.
An app password is used over IMAP, where a tool can read headers and move messages between folders. With either method, what matters most is what the tool chooses to do with the access, which is why the questions below are worth asking.
- Does the tool store message bodies, or only headers?
- Does it delete, or move to a folder you control?
- Does it sell or share anything derived from your mail?
- Can you end its access in one step?
Why Mail Housekeeper uses app passwords
Because the job needs only the mailbox. The housekeeper reads headers, groups senders by company, sends verified unsubscribes, and moves mail between folders in your own account. It never needs your settings, your contacts or your real password, so it never asks for them.
- Your app password is sealed with AES-256-GCM before it reaches our database and opened only by the worker at the moment it connects.
- It is used only to read headers and to move mail between folders inside your own mailbox.
- Delete it at your provider and our access ends that instant. Deleting your account here removes every record we hold.
Make one in two minutes
Each guide has the steps for your provider, phone first: Yahoo, AOL, iCloud and Gmail. Name it Mail Housekeeper so you can find it later, copy it before you close the box, and paste it in. The free scan starts as soon as the sign-in test passes. The three steps show what happens next.