Skip to main content
Finmail

mail

App passwords

Create revocable passwords for Outlook, Thunderbird, and mobile mail — your account password cannot authenticate IMAP/SMTP.

Finmail separates Webmail login (account password + optional 2FA) from mail protocol access (IMAP/SMTP). External clients must use an app password.

Why

If someone steals your account password, 2FA still protects the browser. Without app passwords, that same password would unlock IMAP/SMTP. App passwords:

  • Are rejected for Webmail sign-in (they only work on the mail server)
  • Can be revoked individually without changing your account password
  • Keep your primary password out of desktop and mobile mail apps

Create an app password

  1. Open Settings → Account → Account security.
  2. Under App passwords, enter a label (e.g. MacBook Outlook).
  3. Choose Create and copy the password immediately — Finmail shows it only once.
  4. In your mail client, use your full email as the username and the app password (not your Webmail password).

Server settings remain External mail clients: imap.finmail.com:993, smtp.finmail.com:587.

Revoke

  1. Click Revoke next to the password.
  2. Confirm in the dialog — the password stops working for new IMAP/SMTP logins.
  3. Devices already connected may stay online until they reconnect.

Existing sessions using that password stop working after the next authentication.

Limits

Up to 10 user-created app passwords per account. The Finmail Webmail service uses a separate hidden credential that you cannot revoke from the UI.

Related