App passwords are separate passwords that mail clients (Outlook, Apple Mail, Thunderbird) use for login — instead of your main password. You need them when you have 2FA enabled (which we recommend), because mail clients generally can’t do TOTP. Instead of rigging up a workaround for every client, you use one dedicated app password per client.
When do I need app passwords?
- 2FA active on the mailbox AND a mail client without 2FA support → app password required.
- No 2FA: the main password is enough, app passwords are optional.
We recommend using app passwords even without 2FA if you have several clients — if one gets compromised, you only revoke that client’s app password instead of reconfiguring everything everywhere.
Creating an app password yourself as a user
Via the Mailcow user login page (typically the main page, then “user login”, or directly /user/):
- Log in with mailbox address + main password + 2FA code.
- App passwords → Add.
- In the dialog:
- Name: a descriptive name, e.g. “Apple Mail iPhone” or “Outlook office PC”. So you know later which app password belongs to what.
- Allowed protocols: IMAP, POP3, SMTP, SOGo. For a normal mail client, IMAP and SMTP are enough — only tick POP3 if you actually fetch mail via POP3, SOGo only if you specifically need it.
- Click Add.
Important: Mailcow shows the app password once. Write it down or copy it straight into the mail client — after that it’s no longer visible.
App password format
Mailcow generates app passwords in the format xxxx-xxxx-xxxx-xxxx — four groups of four with dashes, 16 characters in total.
In mail clients, you enter the app password just like a normal password. You can copy the dashes along or leave them out — Mailcow accepts both.
Creating an app password for a user as domain admin
If you want to generate app passwords for an employee as domain admin (say, because they don’t want to log in themselves):
- Configuration → Mailboxes → open the user’s mailbox.
- App passwords tab.
- Add → assign a name → allowed protocols → save.
Copy the generated password and send it to the user via a secure channel (password-manager sharing, in person, never by unencrypted mail).
Revoking an app password
When a device is lost or an employee leaves, revoke the respective app password:
- Mailcow user login → App passwords (or as domain admin in the mailbox edit).
- Click the app password → Delete.
Effective immediately. The mail client gets rejected on its next login attempt; the user has to set up a new app password.
Best practices
One dedicated app password per client. One app password for “Apple Mail iPhone”, one for “Apple Mail Mac”, one for “Outlook work machine”. That way you can revoke selectively if a device goes missing.
Use descriptive names. “App password 1” says nothing. “iPhone XS May 2026” is unambiguous.
Clean up regularly. Every 6–12 months, go through the app passwords and delete those whose devices are gone. Reduces attack surface.
App passwords are not for SOGo webmail. SOGo webmail uses the main password + 2FA code. App passwords are for IMAP/POP3/SMTP — that is, external mail clients on desktop and smartphone. Calendar, contacts and tasks sync via CalDAV/CardDAV through SOGo — how that works is covered in SOGo calendar and SOGo contacts.
Which mail clients need app passwords?
From our experience:
| Client | App password needed with 2FA active? |
|---|---|
| Apple Mail (macOS / iOS) | Yes, always |
| Outlook 2019 / 2021 / 365 | Yes, always |
| Outlook for Mac | Yes |
| Thunderbird | Yes |
| Windows Mail / Outlook (Win 10/11) | Yes |
| K-9 Mail / Thunderbird Mobile | Yes |
| Gmail app (Android) | Yes |
| Stock Android Mail | Yes |
Practically every standalone mail client needs app passwords once 2FA is active.
Frequently asked questions
If I disable 2FA, do the app passwords become invalid? No, they keep working. App passwords are independent of the 2FA status — you can also use them without 2FA, for instance for cleaner separation per client.
How many app passwords can I have? Practically unlimited. Many dozens per mailbox are possible — we’ve seen setups with 50+ apps.
What happens if someone finds out my app password? They can authenticate against the mail server with your mailbox — IMAP/POP3/SMTP. But with the app password they can not access SOGo or change Mailcow settings — that requires main password + 2FA. So: if you suspect an app password is compromised → delete it immediately, create a new one.
Where can I see when an app password was last used? Currently, Mailcow doesn’t show last-login timestamps per app password. If that matters to you (compliance, for example), open a ticket — we can look it up in the server logs.
Do I need app passwords if I only use SOGo webmail? No. SOGo runs with main password + 2FA code. App passwords are only for external clients/apps.
Can I use the app password and the main password for IMAP in parallel? If 2FA is off: yes, both work. If 2FA is on: only the app password; the main password is not accepted without a TOTP code.
How secure are app passwords? Very secure, as long as you handle them cleanly — enter once per client, store nowhere else, revoke on device loss. They are 16-character random strings, so practically uncrackable by brute force.
What if I never changed my initial password and then enable 2FA? Set your own password first when enabling it. Otherwise you end up unable to use your main login (because it’s unknown) with all mail clients running on app passwords — which gets painful if you can no longer find the initial password.
What’s next
First login as domain admin in the Mailcow GUI
After ordering your mail server plan, you get access to the Mailcow GUI. Here's an overview of what you see as domain admin and where to find what.
Creating and editing mailboxes, setting quotas
How to create new mail addresses as domain admin, assign storage quotas, change passwords and delete mailboxes again.
Setting up aliases and a catchall
Route several mail addresses into one mailbox — info@, kontakt@, presse@ all in a single inbox. Plus a catchall for every typo address.
Setting domain-wide Sieve filters as domain admin
Filters that apply to all mailboxes of your domain at once — for example to sort newsletters domain-wide into a specific folder or to reject certain senders.