App Passwords for IMAP and SMTP: Secure Your Business Mailbox
App passwords are single-purpose tokens that let a mail client — Outlook, Thunderbird, your phone — authenticate over IMAP or SMTP without ever seeing your main account password. If that client is compromised, you revoke one token; everything else keeps working.
This guide explains why app passwords matter, how IMAP/SMTP authentication works, and how to lock down your mailboxes on CM Cloud Business Email.
Why Your Main Password Is a Liability in Mail Clients
When you type your main password into a desktop mail client, that password is stored — often in plain text or a reversible format — on that device. One stolen laptop, one phished device, one rogue IT contractor, and your entire email account is exposed.
IMAP and SMTP are decades-old protocols. They were designed to accept a username and password on every connection. Modern security layers (OAuth, 2FA) help, but legacy clients cannot always use them. App passwords fill that gap: they authenticate the protocol without touching your main credentials.
What an App Password Actually Is
An app password is a long, randomly generated string — something like xkgp-rmwt-jlqv-bczn — that your mail server accepts as a valid credential for one specific purpose. It has no value outside that server, and it can be revoked instantly from your dashboard without changing your main login.
Key properties:
– Single-purpose — generated for one device or client
– Revocable — disable it without affecting other sessions
– Non-guessable — entropy is far higher than a human-chosen password
– Protocol-compatible — works with any client that supports plain IMAP/SMTP AUTH
IMAP vs SMTP: Which Direction Does Each Password Cover?
IMAP (port 993 with TLS) handles incoming mail — your client connects to the server and syncs your inbox. Authentication happens on every sync cycle.
SMTP (port 587 with STARTTLS, or 465 with SSL) handles outgoing mail — your client submits messages to the server for delivery. Authentication proves you are authorised to send from that mailbox.
Both protocols use the same credential format. One app password can cover both directions for a given client, or you can generate separate tokens per direction if your security policy requires it.
Recommended Port and Encryption Settings
| Protocol | Port | Encryption | Auth Method |
|---|---|---|---|
| IMAP | 993 | SSL/TLS | PLAIN over encrypted channel |
| SMTP (submission) | 587 | STARTTLS | LOGIN or PLAIN |
| SMTP (alternate) | 465 | SSL/TLS | PLAIN over encrypted channel |
Never use port 25 for client submission — it is for server-to-server relay and is blocked by most ISPs.
How to Generate an App Password on CM Cloud Business Email
CM Cloud Business Email is $1.99/user/mo (XAF 1,250 / €1.85), or the Bundle plan at $4.99/mo (XAF 3,000 / €4.60) for five mailboxes. App password management is built into the webmail control panel.
- Log in to your CM Cloud webmail or email control panel.
- Navigate to Security → App Passwords (or Connected Devices).
- Click Generate New App Password.
- Label it — for example, “Outlook — MacBook Pro” or “Android Gmail App”.
- Copy the token immediately. It will not be shown again.
- Enter the token as the password in your mail client’s IMAP/SMTP settings.
To revoke access for a lost device, return to the same panel and delete that token. The device loses access within seconds — your main password and all other clients are unaffected.
Configuring Your Mail Client
Outlook (Windows / Mac)
- Go to File → Account Settings → Account Settings.
- Select your email account and click Change.
- Replace the Password field with the app password you generated.
- Confirm server settings: IMAP port 993 SSL, SMTP port 587 STARTTLS.
- Click Next and let Outlook test the connection.
Thunderbird
- Open Account Settings → Server Settings.
- Set incoming server to IMAP, port 993, SSL/TLS.
- Go to Outgoing Server (SMTP), edit your server, set port 587, STARTTLS.
- On next send/receive, Thunderbird will prompt for a password — enter the app password.
Mobile (iOS Mail / Android Gmail)
Both mobile clients store the password in the device keychain. Navigate to the mail account settings and replace the stored password with the app password. The process is identical to initial setup — the client will not distinguish between an app password and your main password.
Business Email Pricing: CM Cloud vs Competitors
App password support is a baseline feature for any credible business email provider. Here is how CM Cloud Business Email compares on price:
| Provider | Starter Price (USD) | XAF | EUR | App Passwords / Security |
|---|---|---|---|---|
| CM Cloud | $1.99/user/mo | XAF 1,250 | €1.85 | App passwords, IMAP/SMTP, DKIM, SPF, DMARC |
| Google Workspace | $7/user/mo | ~XAF 4,375 | ~€6.50 | App passwords (2FA required first) |
| Microsoft 365 Business Basic | $6/user/mo | ~XAF 3,750 | ~€5.55 | App passwords (legacy auth deprecating) |
| Zoho Mail | $1/user/mo | ~XAF 625 | ~€0.93 | App passwords available |
CM Cloud Business Email is sold separately from web hosting — it is not bundled with Shared Hosting or WordPress plans. If you need a business mailbox, subscribe to Email Hosting as its own product.
The Email Signatures Add-On: One More Security-Adjacent Feature
Once your mailboxes are secured, consider the Email Signatures add-on at $0.99/mo per domain (XAF 600 / €0.89). Unlike competitors such as CodeTwo and Exclaimer — which charge per mailbox — CM Cloud charges one flat price for the entire domain, regardless of how many users you have.
Signatures are stamped at the mail server level on outgoing authenticated mail. This means every device and every client (phone, Outlook, webmail) carries the correct signature automatically. The signing process is DKIM-safe: the signature is applied before the message is DKIM-signed, so authentication passes and mail does not land in spam.
This add-on requires an active Email Hosting subscription — it is not available as a standalone product.
AI Credits: Available on All Plans
CM Cloud includes AI credits free on all plans, with top-up available from $1.00 / XAF 500 / €0.93 for 25 credits. The table below shows top-up tiers:
| Credits | USD | XAF | EUR |
|---|---|---|---|
| 25 credits | $1.00 | XAF 500 | €0.93 |
| 100 credits | $4.00 | XAF 2,000 | €3.72 |
| 250 credits | $10.00 | XAF 5,000 | €9.30 |
Security Checklist Before You Add a Mail Client
- [ ] Generate a unique app password for each device or client
- [ ] Label every token clearly so you can revoke the right one later
- [ ] Confirm IMAP uses port 993 with SSL/TLS
- [ ] Confirm SMTP uses port 587 with STARTTLS (or 465 SSL)
- [ ] Enable SPF, DKIM, and DMARC records on your domain — CM Cloud Email sets these up automatically
- [ ] Never share app passwords across devices
- [ ] Review and revoke unused tokens quarterly
Get CM Cloud Business Email
CM Cloud Business Email starts at $1.99/user/mo (XAF 1,250 / €1.85) with full IMAP and SMTP support, app password management, and automatic DKIM/SPF/DMARC configuration.
See full pricing and subscribe at cmcloudhosting.com/pricing. If you also run a website, check our hosting plans — email is a separate subscription but pairs cleanly with any plan.