How to Generate and Revoke App-Specific Passwords for Your Apple Account

When connecting third-party applications—such as Mozilla Thunderbird, Microsoft Outlook, Spark Mail, or Android calendar sync utilities—to your iCloud Mail, Contacts, or Reminders, Apple requires you to authenticate using app-specific passwords. These unique, randomly generated credentials protect your primary Apple Account password from third-party storage while ensuring your two-factor authentication (2FA) security remains strictly intact.

Why App-Specific Passwords Are Necessary

Modern Apple Accounts enforce two-factor authentication by default. However, many legacy and third-party desktop email and synchronization programs communicate via standard IMAP, SMTP, CalDAV, and CardDAV protocols that cannot render Apple’s 6-digit verification code prompt. App-specific passwords bridge this gap:

• Credential Isolation: If a third-party application suffers a security breach, your master Apple Account password is never exposed.
• Granular Revocation: You can revoke access for an individual app at any time without resetting your main password or disconnecting other services.
• Security Limit: Apple allows up to 25 active app-specific passwords simultaneously per account.

Prerequisites Before Generating Passwords

To generate app-specific passwords, your account must meet two basic criteria:

1. Two-Factor Authentication: 2FA must be turned on for your Apple Account (standard across all modern Apple devices).
2. Web Access: Passwords must be generated via the official Apple Account management portal in a web browser.

Step-by-Step Guide: How to Generate an App-Specific Password

Follow these steps to create a new dedicated app password:

1. Navigate to the official Apple Account login page at account.apple.com using any web browser on desktop or mobile.
2. Sign in using your Apple Account credentials (email or phone number and password), followed by entering the 6-digit two-factor authentication code sent to your trusted Apple device.
3. In the Sign-In and Security section, select App-Specific Passwords.
4. Click or tap Generate an app-specific password (or the plus + button).
5. Enter a descriptive label: Provide a recognizable name for the application you are configuring (for instance, “Thunderbird Linux” or “Outlook Work Laptop”). This label helps you identify the token later.
6. Click Create and enter your Apple Account master password when prompted to verify your identity.
7. A 16-character password grouped with hyphens (e.g. abcd-efgh-ijkl-mnop) will appear on screen.
8. Copy this password and paste it into the password field of the third-party application you are setting up.

How to Revoke an Individual App-Specific Password

If you stop using a particular email client, replace your computer, or suspect an app has been compromised, revoke its dedicated password immediately:

1. Return to account.apple.com and sign in.
2. Click Sign-In and Security, then select App-Specific Passwords.
3. Locate the application label in the list of active passwords.
4. Click the Delete button (cross or minus icon) next to that specific app name.
5. Confirm the revocation. The application will immediately lose access to your iCloud data.

How to Revoke All App-Specific Passwords at Once

If you ever perform an emergency security audit or change your primary Apple Account password:

1. In the App-Specific Passwords screen, select Revoke All at the bottom of the list.
2. All connected third-party clients will be disconnected simultaneously until you generate new individual passwords for each service.
3. Note: Changing your primary Apple Account password automatically invalidates all existing app-specific passwords as an automated security measure.

Generating app-specific passwords allows you to access iCloud services freely across non-Apple platforms while maintaining enterprise-grade protection over your core account identity.