App passwords: create, name and revoke
An app password is a separate credential for a mail client. Clients that connect to ITProMail over IMAP or SMTP use an app password instead of your account login password. Your login password stays with webmail, and each client gets its own credential that you can revoke without touching anything else.
When you need one
Use an app password for any desktop or mobile client that connects to imap.itpromail.com or smtp.itpromail.com, including Thunderbird, Apple Mail, K-9 Mail, aerc and mutt. The client username is your full email address, and the password field takes the app password. Each account can hold up to 20 app passwords.
Create an app password
- Log in at itpromail.com/login/.
- Open Account > Security.
- In the app passwords section, choose the option to create a new one.
- Give it a name that identifies the client and device, such as
thunderbird-laptopork9-pixel. The name is how you will find it later. - Copy the generated value right away and store it in a password manager. If you lose it, create a new app password and revoke the old one.
Settings for a client
| Setting | Value |
|---|---|
| IMAP server | imap.itpromail.com, port 993, TLS |
| SMTP server | smtp.itpromail.com, port 465 (TLS) or 587 (STARTTLS) |
| Username | Your full email address |
| Password | The app password |
Revoke an app password
Open Account > Security, find the app password by name, and revoke it. After that, the client fails the next time it tries to authenticate with it. Remove or update the account in that client at the same time so it does not keep retrying with a credential that no longer works.
Practices that keep this manageable
- Create one app password per client or device. Do not share one across several.
- Revoke an app password when you retire a device, reinstall a client with a new credential, or stop using a client.
- If you see an app password you did not create, revoke it, change your login password, and review your active sessions in Account > Security.
- Keep the values in a password manager rather than in plain-text configuration files wherever you can.
An app password does not replace two-factor authentication. Turn on TOTP or FIDO2 in Account > Security as well; see the TOTP guide and the FIDO2 guide. For the full server reference, see IMAP and SMTP settings. If logins still fail after you have set up a new app password, go to troubleshooting login failures.