Generate an App-Specific Password for Zoho Mail for Outlook, Thunderbird and Web Apps
Quick Answer A Zoho Mail app-specific password is a separate credential that allows compatible applications to access your Zoho Mail account. You can generat...
Quick Answer
A Zoho Mail app-specific password is a separate credential that allows compatible applications to access your Zoho Mail account. You can generate one for applications such as Microsoft Outlook, Mozilla Thunderbird, and supported third-party business applications or web apps that connect to Zoho Mail using an appropriate password-based authentication method.
To generate the password, sign in to Zoho Accounts, open Security > App Passwords, select Generate New Password, enter a descriptive application name, and generate the password. Copy and save it securely because Zoho displays the generated password only once.
Use this password in place of your regular Zoho account password when the application's supported authentication method requires an app-specific password. Not every web application supports this method; some require OAuth authentication or another integration method.
What Is a Zoho Mail App-Specific Password?
An app-specific password is a separate credential generated through Zoho Accounts to authorize compatible applications to access your Zoho Mail account. It is different from your regular Zoho account password and is intended for application connections that use supported password-based authentication.
Zoho recommends using application-specific passwords for email clients, including when multi-factor authentication (MFA) is not enabled. When MFA is enabled, an app-specific password is required for supported password-based POP or IMAP email-client access instead of the regular account password.
Depending on the application and integration, this credential may be used with email clients, standalone applications, or business software that connects to Zoho Mail. The application must support the relevant authentication method and connection protocol.
Where Can You Use a Zoho Mail App-Specific Password?
- Microsoft Outlook: For a compatible Zoho Mail account configured through a supported IMAP or other password-based connection.
- Mozilla Thunderbird: For a supported Zoho Mail email account using IMAP or POP authentication.
- CRM and business applications: For supported integrations that connect to Zoho Mail to retrieve or send email.
- Web applications: For server-side applications that support connecting to Zoho Mail through compatible email protocols or authenticated SMTP services.
- Custom software and utilities: For applications that explicitly support Zoho Mail credentials and the required authentication method.
Important: An app-specific password is not a universal password for every website or web application. A web app that supports only OAuth, an API token, or a different email provider's authentication system may not accept a Zoho app-specific password.
Requirements Before Generating the Password
- You must be able to sign in to the relevant Zoho account.
- You must complete any security verification required by Zoho.
- You should identify the application or service that needs access.
- The application must support the required Zoho Mail authentication method.
- For IMAP or POP connections, the relevant protocol must be enabled and permitted for your account.
- For organizational accounts, your administrator may need to permit external email-client access or the required integration.
How to Generate an App-Specific Password for Zoho Mail
Step 1: Sign in to Zoho Accounts
Open https://accounts.zoho.com/ and sign in using the Zoho account associated with the mailbox you want to connect.
If your organization uses a regional Zoho data center, use the appropriate Zoho sign-in portal for your account.
Step 2: Open Security Settings
After signing in, navigate to the Security section of your Zoho Accounts settings. Locate App Passwords or the equivalent application-specific password setting.
This setting is managed through Zoho Accounts. You may not find it directly in the main Zoho Mail inbox.
Step 3: Generate a New Password
Select Generate New Password. When prompted, enter a descriptive name for the application that will use the credential.
Examples include:
- Outlook - Office Computer
- Thunderbird - Laptop
- Business CRM Email Integration
- Website SMTP Mailer
- Custom Application - Notifications
Choose a name that helps you identify the application later. The name is only a reference label and does not replace your Zoho email address or username.
Step 4: Generate and Save the Password
Click Generate. Zoho will display the newly generated app-specific password.
Copy the password immediately and store it securely. The password is displayed only once. If you lose it, generate a replacement rather than expecting Zoho to reveal the original password again.
Do not share the password in screenshots, public support forums, unsecured documents, or messages to people who do not need access.
Step 5: Enter the Password in the Target Application
Open Microsoft Outlook, Mozilla Thunderbird, your CRM, or the compatible web application. Enter your Zoho email address and use the generated app-specific password wherever the application requests the password for a supported password-based Zoho Mail connection.
If the application uses OAuth authentication, follow its OAuth sign-in process instead. Do not assume that an app-specific password can replace OAuth credentials, API keys, or other tokens.
Using the Password in Microsoft Outlook
If you are adding a Zoho Mail account to Microsoft Outlook using a supported manual IMAP configuration, the app-specific password may be required, particularly when MFA is enabled.
- Open Microsoft Outlook and start adding your Zoho Mail account.
- If automatic setup does not work, select the available manual or advanced configuration option.
- Choose the supported IMAP configuration if that is the connection method required by your account.
- Enter your complete Zoho email address as the username when required.
- Enter the Zoho app-specific password in the password field for password-based authentication.
- Configure the incoming and outgoing servers using the current settings applicable to your Zoho account and data center.
- Save the configuration and test sending and receiving messages.
For supported IMAP configurations, Zoho documents the following common settings. Confirm the server names for your account before using them.
| Setting | Common configuration |
|---|---|
| Incoming protocol | IMAP |
| Incoming server for personal accounts | imap.zoho.com |
| Incoming server for many paid organization accounts using a custom domain | imappro.zoho.com |
| Incoming port | 993 with SSL/TLS |
| Outgoing server for personal accounts | smtp.zoho.com |
| Outgoing server for many paid organization accounts using a custom domain | smtppro.zoho.com |
| Outgoing port | 465 with SSL or 587 with TLS, as supported by the account configuration |
| Username | Your complete Zoho email address, where required |
Zoho server names can vary by account type and data center. Use the server configuration provided for your mailbox if it differs from the examples above.
For detailed instructions, consult Zoho's Outlook configuration guidance and the official Zoho Mail IMAP documentation.
Using the Password in Mozilla Thunderbird
Mozilla Thunderbird can connect to Zoho Mail through a supported IMAP configuration. If MFA is enabled on your Zoho account, use an app-specific password when the connection uses password-based authentication.
- Open Thunderbird and add a new email account.
- Enter your display name, complete Zoho email address, and the required password.
- Allow automatic configuration to detect the account settings, or choose manual configuration if necessary.
- Check that the incoming server uses the appropriate IMAP hostname and port.
- Check that the outgoing SMTP server and encryption settings match Zoho's configuration for your account.
- Use the app-specific password for the supported password-based connection.
- Save the configuration and verify that messages synchronize and outgoing mail works.
For account-specific server names and detailed setup instructions, see Zoho's official Thunderbird IMAP setup guide.
Using the Password in a Web Application or Business Software
A web application may need to connect to Zoho Mail to send notifications, deliver contact-form messages, send invoices, or communicate with customers. Whether an app-specific password is appropriate depends on how the application integrates with Zoho.
Scenario 1: The Web Application Supports SMTP Authentication
If the application sends email through Zoho's SMTP service and supports password-based SMTP authentication, it may accept your Zoho app-specific password as the SMTP password when required by your account configuration.
Configure the application with the correct SMTP hostname, port, encryption method, username, and sender address. Use the current settings specified by Zoho for your account type and data center.
Scenario 2: The Web Application Connects Through IMAP or POP
If the application retrieves or synchronizes email through IMAP or POP, it must support the relevant protocol and authentication method. Enable the required protocol in Zoho Mail and use the appropriate app-specific password when necessary.
Scenario 3: The Web Application Uses OAuth or an API
Some applications require OAuth authorization, API credentials, or a provider-specific integration instead of a mailbox password. In that case, use the authentication method supported by the application. Do not place an app-specific password in an unrelated API key, token, or OAuth field.
Security Recommendations for Web Applications
- Store credentials in the application's protected configuration or secret-management facility.
- Do not embed the password in publicly accessible HTML, JavaScript, or client-side code.
- Do not commit credentials to public source-code repositories.
- Restrict access to configuration files and application logs.
- Use a dedicated credential for the integration where practical, and revoke it when the integration is retired.
- Use TLS encryption and the server settings recommended by Zoho.
For websites hosted on shared hosting or a cloud server, ensure that the application sends mail through a supported server-side mail integration. Generating the password alone does not configure the website's mail transport.
Common Problems and Solutions
App Password Option Is Missing
Sign in to Zoho Accounts and open the Security section. Look for App Passwords. If the option is unavailable, check your account configuration and any organizational restrictions, or contact your administrator or Zoho support.
The Regular Zoho Password Is Rejected
When MFA is enabled, supported password-based POP or IMAP email-client access requires an app-specific password rather than the regular account password. Generate the app-specific password and update the application's saved credential.
The Application Rejects the App-Specific Password
- Check that the entire password was copied correctly and contains no extra spaces.
- Confirm that the username is the correct Zoho email address or other username required by the application.
- Verify the server hostname, port, and encryption settings.
- Check whether IMAP, POP, or SMTP access is enabled and permitted.
- Confirm that the application supports the selected password-based authentication method.
- If the credential was revoked, generate a replacement and update the application.
The Web Application Still Cannot Send Email
Check whether the application is using SMTP rather than an unrelated API or mail transport. Confirm the SMTP server, port, encryption, authentication settings, and permitted sender address. If the application requires OAuth or another supported authentication method, an app-specific password alone will not resolve the issue.
The Password Was Lost
Zoho displays the generated password only once. Generate a new app-specific password, update the application that needs access, and revoke any unused credential where appropriate.
How to Revoke an App-Specific Password
If an application is no longer in use, a device has been lost, or you suspect a password has been exposed, revoke the credential.
- Sign in to Zoho Accounts.
- Open Security > App Passwords.
- Locate the credential using its application name.
- Select the available delete or revoke option.
- Confirm the action if prompted.
- Update any legitimate application that still requires access with a newly generated password.
Revoking an app-specific password removes the access associated with that credential. It does not, by itself, change your regular Zoho account password.
How to Verify the Configuration
- Save the account settings in the target application.
- Confirm that the application authenticates successfully.
- For IMAP, verify that the inbox and folders synchronize.
- For SMTP, send a test message to an address you control.
- Check the application's error log if the connection fails, ensuring that logs do not expose passwords or other credentials.
If authentication succeeds but sending or receiving fails, investigate the relevant mail protocol, server settings, permissions, or sender restrictions separately. A successful password generation does not guarantee that every application or connection method is supported.
Frequently Asked Questions
Can I use one Zoho app-specific password for Outlook, Thunderbird, and a web application?
Zoho generates application-specific credentials for use with compatible applications. For clearer access management, create separately named passwords for different applications where practical. Follow Zoho's current account controls and the target application's requirements.
Does an app-specific password work with every web app?
No. It works only when the application supports a compatible Zoho Mail connection and authentication method. Applications that require OAuth, API tokens, or other authentication mechanisms need those credentials instead.
Do I need MFA to generate an app-specific password?
Zoho recommends application-specific passwords for email clients even when MFA is not enabled. However, account policies and the authentication method may affect what is available or required for a particular connection.
Is the Zoho app-specific password the same as my Outlook password?
No. It is generated from Zoho Accounts for access to your Zoho Mail account. It is not a Microsoft account password and should not be used to sign in to an unrelated Microsoft mailbox.
Will generating the password automatically configure my application?
No. You must still configure the application with the correct account, server, protocol, encryption, and authentication settings.
Can I revoke the password without changing my Zoho account password?
Yes. You can revoke an individual app-specific password through Zoho Accounts. If you suspect that your main account has also been compromised, take the additional account-security measures recommended by Zoho.
Conclusion
A Zoho Mail app-specific password can help connect your mailbox to Microsoft Outlook, Mozilla Thunderbird, and compatible business or web applications. Generate it through Zoho Accounts, use it only with a supported authentication method, and keep it securely stored. For applications that require OAuth or another integration method, follow the application's supported setup instructions instead.
Sources
Was this guide useful?
Your answer helps us keep BISONKB accurate and practical.