Why do I need OAuth2 and app passwords for IMAP?

You’re using Thunderbird or Outlook to check your email. It works — until it doesn’t. Suddenly, it can’t authenticate. You’re told your password is wrong, even though you’re typing it right.

That’s because modern email hosting no longer accepts plain password logins for secure IMAP clients. Instead, you need OAuth2 or app passwords — not because it’s complicated, but because plain passwords are a security risk.

Email hosting with OAuth2 and app passwords for IMAP clients isn’t a feature you add for convenience. It’s how you keep your inbox safe while still using tools you trust.

Key takeaways

  • OAuth2 and app passwords eliminate the need to store your master password in IMAP clients.
  • They enable secure, long-lived access without compromising your account’s primary credentials.
  • Using app passwords with modern email hosting is required for IMAP clients that don’t support OAuth2, like legacy versions of Thunderbird or Outlook.

How OAuth2 protects your email with IMAP clients

OAuth2 lets IMAP clients access your email without storing your password. Instead, they use short-lived tokens that expire quickly and can be revoked instantly—so even if a client is compromised, your account stays secure. This is how modern email systems protect your inbox.

Why passwords are a security risk for IMAP

Traditional IMAP clients often require your password to log in. That means either you store it in plain text on your device or trust that the app won’t leak it. That’s risky—especially if the app is outdated or uses weak encryption.

Every time you reuse a password across apps, you increase your exposure. If one service is breached, attackers can try the same credentials elsewhere. OAuth2 eliminates that risk by replacing your password with a token that’s tied to a specific app and has a limited lifespan.

How OAuth2 reduces real-world threats

OAuth2 tokens are short-lived—often valid for minutes or hours, not months. Even if a hacker intercepts one, it won’t work later. This is standard practice in secure systems; the OAuth 2.0 specification is explicit about minimizing access duration to reduce exposure.

More importantly, you can revoke access at any time—no need to change your main password. Let’s say you lose your phone or suspect a third-party app is acting suspiciously. With OAuth2, you can disable just that app’s token instantly through your account settings.

Unifiedesk’s hosted platform enables OAuth2 for IMAP clients, letting you use any modern email app—like Thunderbird, Spark, or Apple Mail—without storing your password on any device. You stay in control, and your data stays protected. See how secure access works on your own domain: private email with full security controls.

When do I need an app password instead of OAuth2?

You need an app password when your IMAP client doesn’t support OAuth2—common with older mobile apps, email gateways, or legacy software. OAuth2 is the modern, secure way to authenticate, but not all apps have caught up. App passwords are long, randomly generated codes that grant limited access without exposing your main password. They’re only required in cases where OAuth2 is unavailable, not as a fallback for every app.

Legacy clients and missing OAuth2 support

Some older email clients, especially on Android or iOS, don’t offer OAuth2 login options. You may see an error like “Authentication failed” when trying to connect, even with a working password. This happens because those apps can’t handle the OAuth2 flow—no modern web redirect, no token refresh. In such cases, an app password acts as a secure, single-use alternative to your main password.

Even some email forwarding services or SMTP gateways (like certain home automation tools) may only accept password-based auth. These systems often can’t handle the complex token exchange required by OAuth2, making app passwords the only viable path.

How app passwords work

App passwords are generated per app or device, not per user. For example, your iOS Mail app gets one, your desktop client another. They’re long—usually 16-32 characters of random letters, numbers, and symbols—and can be revoked individually, without changing your main password.

They’re designed for single-use contexts: a client that can’t do OAuth2 but still needs secure access. They’re not “less secure” by design—they’re a well-recognized compromise. As defined in RFC 8651, app-specific credentials are a standard fallback for environments that can’t support modern auth protocols.

At Unifiedesk, we support both OAuth2 and app passwords for maximum compatibility. You can generate app passwords for clients that need them, while maintaining strong security across the board. If you're using a third-party tool that refuses OAuth2, check your custom domain setup to enable app password access.

For more on how we handle authentication securely, see our security page.

How to set up OAuth2 for IMAP with Unifiedesk

You can securely connect IMAP clients like Thunderbird or Apple Mail to Unifiedesk using OAuth2 instead of app passwords. This reduces risk by eliminating shared secrets and supports modern authentication standards. Follow the steps below to enable OAuth2 and configure your client with a token issued by your Unifiedesk account.

Enable OAuth2 in Unifiedesk

  1. Log in to your Unifiedesk web interface using your primary email and password. This is the only trusted entry point to manage app access and security controls.
  2. Navigate to Settings > Security > App Access. This section manages how external applications authenticate with your email and calendar services, including IMAP and JMAP clients.
  3. Enable OAuth2 for IMAP clients and click Generate new application-specific token. This creates a short-lived, scoped access token tied to your account and application, avoiding the need for long-term passwords.
  4. Copy the generated token and note the application name and domain (e.g., yourdomain.unifiedesk.com). Save this in a secure place—once closed, you won’t see it again.

Configure Your IMAP Client

Set up your IMAP client (like Thunderbird, Mailbird, or Outlook) using the OAuth2 flow with the token you generated. Most clients support OAuth2 via standard OAuth 2.0 authorization framework, especially through the STARTTLS and PLAIN mechanism over secure connections. This approach is now standard in email clients, widely adopted by providers like Google and Fastmail.

When prompted for credentials during setup, use your email address ([email protected]) and the OAuth2 token as the password. The client will then authenticate via the Unifiedesk OAuth2 endpoint without storing your primary password.

OAuth2 eliminates the need to expose your primary password to third-party clients, reducing the risk of phishing or credential reuse attacks.

For advanced setups, you can also use Unifiedesk’s open-source engine to run a self-hosted instance with full control over authentication flows. See how self-hosting gives you complete privacy and compliance autonomy.

Once configured, your IMAP client will sync securely using OAuth2. You can manage or revoke tokens anytime from Settings > Security > App Access. For more on email security, explore Unifiedesk’s security practices or learn how to set up custom domains at onboarding.

How to generate and use app passwords for IMAP

You can securely access your email via IMAP clients like Thunderbird or Outlook by generating a dedicated app password instead of using your main account password. This prevents exposing your primary credentials while enabling access, especially when two-factor authentication (2FA) is enabled. App passwords are a standard security practice in email platforms that support OAuth2-based authentication.

Generate an app password in your Unifiedesk account

  1. Go to Settings > Security > App Passwords. This section is where you manage access tokens that act as temporary, limited-use passwords for apps.
  2. Click 'Create new app password'. The system will prompt you to label the app or device, helping you track which password corresponds to which client later.
  3. Assign a meaningful label, such as "Thunderbird on Laptop" or "Android Mail Client." This label appears in your list of active app passwords and helps you identify the source if you need to revoke access.
  4. Copy the generated 16-character code immediately. Once you leave the page, you won’t be able to view it again. Treat it like a password — keep it secure and never share it.
  5. Enter the 16-character code as the password in your IMAP client. Never enter your main account password here. This protects your account even if the app password is compromised.

Why use app passwords with IMAP?

IMAP clients often don’t support modern OAuth2 flows, especially older or non-UI-first apps. App passwords bridge this gap by providing a secure, one-time-use override for authentication. RFC 6749 (the OAuth2 standard) acknowledges that legacy systems need fallbacks, and app passwords are one such mechanism commonly used by providers like Google, Fastmail, and Proton Mail.

App passwords are not a weakness — they’re a control mechanism. They’re tied to a single application and can be revoked at any time without affecting other devices. If you use the unified client across multiple devices, each should have its own app password.

For added security, you can disable app passwords entirely via your security settings. If you're using a self-hosted instance of Unifiedesk, you can also audit access logs or integrate with a reverse proxy for deeper visibility.

Learn more about how Unifiedesk secures your mailbox with end-to-end encryption and per-account keys, even for IMAP access: security features.

OAuth2 vs App Passwords: What’s the real difference?

OAuth2 is the modern, secure way to grant apps access to your email—no passwords needed. App passwords are a legacy fallback for clients that don’t support OAuth2, but they’re less secure since they’re static and hard to revoke. If your email client supports OAuth2, use it; otherwise, an app password is your only option—but treat it like a password: keep it safe and regenerate if it leaks.

Why OAuth2 is the future

OAuth2 lets apps request access without ever seeing your password. Instead, you authorize a specific scope—like "read mail" or "send messages"—and the app gets a time-limited token. This means if a device gets compromised, you can revoke access instantly.

It’s also scalable. You don’t need a new password every time you add a new device or client. You just re-authenticate through your account’s secure interface. This is how Google, Microsoft, and most secure platforms handle access today, and it’s backed by the IETF's OAuth 2.0 specification.

When app passwords still matter

Some older email clients—especially mobile apps or legacy desktop software—don’t support OAuth2. For them, app passwords are a necessary but less ideal workaround. They’re long, static, and act like full passwords, so losing or exposing one means you need to regenerate it immediately.

You can’t revoke a single app password remotely—only by replacing it. That’s why they’re not recommended for high-security use cases. But they’re still used widely where modern standards aren’t available.

With Unifiedesk, you can set up email hosting with custom domains that support both OAuth2 and app passwords, depending on your client. And if you're managing multiple users, our self-hosted option gives you full control over which authentication methods are allowed.

So, use OAuth2 when you can. If you can’t, use app passwords—but don’t treat them as permanent. Treat them like any other sensitive credential: secure, limited in scope, and replaceable.

What about IMAP security and encryption with Unifiedesk?

With Unifiedesk, your IMAP traffic is always encrypted in transit using TLS 1.3—enforced by default—and your messages and files are end-to-end encrypted by design. App passwords are never stored in plaintext; they’re managed securely through our app access system, which prevents accidental exposure and supports zero-trust access without compromising usability. You get enterprise-grade security without the overhead.

TLS 1.3 and IMAP in transit

Let’s be clear: IMAP traffic isn’t just encrypted—it’s protected using TLS 1.3, the current industry standard for transport security. No exceptions. When you connect via IMAP clients, Unifiedesk enforces TLS 1.3 for every connection. This means your login details, messages, and metadata are shielded from passive network eavesdroppers and man-in-the-middle attacks. The RFC 8446 specification mandates robust key exchange and forward secrecy—exactly what you need for reliable, up-to-date protection.

End-to-end encryption and app access

On the hosted platform, all messages and files are end-to-end encrypted—your mail isn’t readable by Unifiedesk’s servers, not even when stored. This isn’t a “data-at-rest” feature; it’s the default. Even your IMAP client sees only encrypted data, decrypted only on your authenticated device. If you use app passwords for clients like Thunderbird, Outlook, or mobile apps, they’re not stored in plaintext. Instead, they’re managed in a secure token system tied to your account’s access policies. You can revoke them instantly, and they are never logged or exposed in any form.

For self-hosted deployments, we use AES-256-GCM encryption at rest with per-account keys—meaning your data is protected even if physical storage is compromised. The same applies to files in Drive or documents in your workspace. You control where your data lives, and how it’s encrypted. If you enable OAuth2, we use standard protocols for authorization without storing passwords, so your login credentials stay secure.

When you’re using IMAP clients, you’re not just using a protocol—you’re using a secure, modern setup. Unifiedesk handles the complexities. You don’t need to tweak TLS versions, manage keys, or remember encryption schemes. Everything’s handled automatically. If you'd like to explore how this works with your own domain, you can get started with custom domain setup in minutes.

You don’t need to choose between security and usability. Unifiedesk gives you both—backed by open-source design, real encryption practices, and no hidden access points. For deeper control, you can also explore self-hosting if your needs require full infrastructure ownership.

Why not just use my main password for IMAP?

Using your main password for IMAP is a security risk: it exposes your primary account credentials to third-party apps, many of which don’t even encrypt them in transit. If the app is compromised, your password is too. Since 2018, Google, Microsoft, and others have blocked password-based IMAP logins entirely for this reason — and you're better off avoiding legacy practices that weaken your security posture.

IMAP clients can’t be trusted with your password

When you hand your main password to an IMAP client, you’re giving it something you only ever intended to use once — for your primary login. But IMAP apps store passwords in plain text or weakly encrypted formats on your device, which increases risk if the device is lost or infected.

Even if the provider still allows password-based IMAP, it's not future-proof. Major email platforms now require app-specific passwords or OAuth2 to limit access. This isn’t just about policy — it's about reducing the lifetime of a credential that, if leaked, could grant access to everything you’ve ever used that account for.

OAuth2 and App Passwords are the safer alternative

App passwords are short-lived, single-purpose tokens that let IMAP clients connect without risking your master password. They’re used by providers like Gmail and Outlook, and they’re mandatory for any app that needs persistent access to an inbox.

OAuth2 takes this further. It lets apps request permission dynamically, without ever seeing your password. You grant access, and the app gets a token — one that can be revoked instantly, even from a remote device. This is how industry standards like RFC 6749 define secure authorization.

Unifiedesk supports both: you can generate app passwords for older clients, or use OAuth2 with modern ones. Either way, your core password stays safe. The platform treats every connection as a separate authorization event — not a one-time trust.

With Unifiedesk, you can set up your domain email with full IMAP control while keeping your login secure. For more details on how we handle authentication, see our security page. Or get started with your first custom domain in minutes at our onboarding tool.

Can I use both OAuth2 and app passwords on the same account?

Yes — Unifiedesk lets you use OAuth2 and app passwords simultaneously on the same account. You can enable OAuth2 for modern clients that support it, while still using app passwords for older or restricted tools that don’t. All access attempts are logged and can be reviewed or revoked individually — no need to surrender one to keep the other.

Modern clients get OAuth2, legacy ones get app passwords

Let’s say you’re using the latest version of Apple Mail or Thunderbird with full OAuth2 support. You’ll sign in using your credentials and an authorization token — secure, standardized, and designed to avoid storing passwords on devices.

But maybe you still have that old Android email app or a legacy script that needs a password. For those, Unifiedesk generates a unique app password — a disposable, per-client key that doesn’t expose your main account password.

Visibility and control: know who’s in, and when

Every login — whether via OAuth2 or an app password — appears in your access log. You can inspect timestamps, IP addresses, and device types. If something looks off, you can revoke access instantly without affecting other clients.

OAuth2 is preferred because it eliminates password storage on third-party apps. The OAuth 2.0 specification defines a widely adopted standard for secure delegated access — used across the web, not just email. It reduces risk compared to shared passwords.

Still, app passwords exist for real-world compatibility. You’re not forced to choose one or the other. Unifiedesk gives you the flexibility to match your needs without sacrificing control.

Whether you’re managing a personal domain or running a team, this dual setup balances security, compatibility, and user freedom. You can even disable any specific app password later — no cascading effects.

How to revoke or reset app passwords and OAuth2 tokens

You can revoke or regenerate app passwords and OAuth2 tokens anytime from your account’s Security settings. This instantly cuts off access for any app using the old credential, forcing it to reconnect with a new one. It’s the best way to secure your account after a device is lost, a third-party app is compromised, or you simply want tighter control. For reference, OAuth2 is defined in RFC 6749 — the standard for authorization in modern apps.

Revoke or regenerate tokens: the step-by-step process

  1. Go to Settings > Security > App Passwords or OAuth2 access. This menu shows all active third-party connections using your account, whether for email clients, calendar syncs, or automated tools.
  2. Look for the active token or app password. Each one has a label (like “Outlook on iPhone” or “Calendar Sync”) and a date it was created. This helps you identify what access you’re revoking.
  3. Click ‘Revoke’ or ‘Regenerate’. Choosing this immediately invalidates the current credential. The action is irreversible — you’ll need to reconfigure your app with the new one.
  4. Existing clients disconnect and must reconnect. Any app using the old token (like a mobile email client or desktop calendar) will lose access and prompt you to log in again. This happens instantly — no waiting.
  5. Use the new credential to reconnect. After regenerating, copy the new app password or OAuth2 token and enter it in the app as you would during initial setup. This is especially important for apps that don’t auto-refresh tokens.

Why this matters for your privacy and control

Revising app-level access is not just about convenience — it’s a core part of zero-trust security. Each app password or OAuth2 token is a backdoor into your account. If one is exposed, revoking it stops further use immediately. According to the IETF’s RFC 6749, OAuth2 is designed to allow granular, temporary access without long-lived passwords — but only if you manage tokens responsibly.

With Unifiedesk, you have full visibility and control. You can manage app passwords for IMAP clients, sync your calendar, or integrate third-party tools — all without leaking data to a cloud provider that might scan your mail. For advanced users, the same rules apply in self-hosted deployments, where you manage access on your own server.

See how Unifiedesk supports secure, private collaboration: email, calendar, video meetings, and file storage — all with end-to-end encryption by default for hosted accounts.

Final thoughts: email access with security and privacy

OAuth2 and app passwords aren’t optional extras—they’re essential for managing secure access to email in 2026. They let you trust your tools without trusting their code with your password.

Unifiedesk gives you both: OAuth2 for modern, secure login, and app passwords for legacy IMAP clients that don’t support it. You decide which apps get access and when.

Your master password stays private. No credential leaks. No third-party access to your inbox. You keep full control—your data, your rules, your sovereignty.

Ready to put this into practice? Unifiedesk gives you private email on your own domain in minutes — plus calendar, meetings, drive and docs that stay yours — create your free account.

Frequently asked questions

Does Unifiedesk support OAuth2 for IMAP?

Yes, Unifiedesk supports OAuth2 for IMAP clients on its hosted platform, enabling secure access without storing your password.

Can I use app passwords with Unifiedesk?

Yes, Unifiedesk allows app passwords for IMAP clients that do not support OAuth2, including legacy email apps.

Are app passwords safe?

App passwords are safe when used correctly: they are single-use, revocable, and never stored in plaintext.

Why is OAuth2 better than a password?

OAuth2 uses temporary tokens with limited scope, reducing exposure risk and allowing instant revocation.

Can I disable password-based IMAP entirely?

Yes—Unifiedesk enforces TLS and supports only OAuth2 or app passwords, effectively disabling password-based IMAP.

How many app passwords can I create?

You can create unlimited app passwords, each with its own label and revocation timeline.

Do app passwords work with mobile email apps?

Yes, most mobile apps support app passwords when OAuth2 is unavailable, though compatibility varies.

Is my email encrypted when using OAuth2?

Yes—Unifiedesk’s hosted platform provides end-to-end encryption, regardless of authentication method.

How do I know if my client supports OAuth2?

Check your client’s settings: if it asks for an OAuth2 token, it supports it; if it only takes a password, use an app password.

Can I generate an app password without logging in?

No—app passwords are generated only through the Unifiedesk web interface after authenticating with your main account.

What happens if I lose my app password?

You can regenerate it immediately from the app password settings—no changes to your master password are needed.

Are app passwords compatible with self-hosted Unifiedesk?

Yes, self-hosted deployments support both OAuth2 and app passwords, with all data stored under per-account keys.