Gmail2-Step Verification, then an app password
iCloud MailAn app-specific password
OutlookSign in with Microsoft
Yahoo MailAn app password
Zoho MailIMAP on, sometimes an app password
Yandex MailMail apps on, then an app password
AOL MailAn app password
Any other addressUsually your mail passwordWhat an app password is, in one minute
Gmail, iCloud, Yahoo, AOL and Yandex don’t let mail apps use your normal password. Instead you go to their website and ask for a second password made just for one app. It looks like random letters, like abcd efgh ijkl mnop.
It sounds technical, but it’s three clicks and a paste. Each page above shows every click.
Why it’s safe
- You make it on your provider’s own website (google.com, apple.com, yahoo.com…), never in Roost. Roost never sees your real password.
- It stays on your Mac. Roost keeps it in the macOS Keychain, the same locked store Safari uses. Roost has no server and no account to sign up for, so there’s nowhere else for it to go.
- You can cancel it any time on your provider’s page, without changing your real password.
Questions people ask
Why not just use my normal password?
Your provider won’t accept it. Gmail, iCloud, Yahoo, AOL and Yandex refuse normal passwords in mail apps, so a leaked mail app can never give away the password to your whole account.
Do I need two-factor authentication?
For Gmail (2-Step Verification) and iCloud (two-factor authentication), yes: that’s their rule for app passwords. Yahoo, AOL and Yandex don’t require it. Outlook needs nothing extra. Each page says how to turn it on.
Will I need my phone every time Roost checks mail?
No. You may need your phone once, on the provider’s page. Roost connects with the app password on its own after that, even after a restart.
Does Roost have a server that sees my mail?
No. Roost talks straight from your Mac to your provider. Every place it connects to is listed, with what it sends, on Where your mail goes.
What if I change my real password later?
Google and Apple cancel your app passwords when you change your account password: make a new one and use Settings › Sign in again in Roost. Yahoo and AOL keep them until you delete them.
How do I take away Roost’s access?
Delete the app password on your provider’s page and Roost can’t get in any more. In Roost, Settings › Remove Inbox… deletes the mail Roost saved and the password from your Keychain. Each page has the exact steps.
I’m stuck. Can I ask someone?
Yes, me. Write to [email protected] and say which provider and what Roost said. Never send your password.