Your IMAP password is your email account password. There is no separate “IMAP password” to create or discover — when a mail app asks for one, it wants the same password you use to sign in to your webmail. And if you’ve forgotten it, you can’t look it up anywhere: it’s stored as a one-way hash on the server, which means the only real option is to reset it.
That answer disappoints people looking for a way to retrieve a forgotten password, but it’s the truth, and knowing it saves a lot of wasted effort. This guide explains what the IMAP password actually is, how to reset it depending on your provider, when you need an app password instead, and why your mail client may keep asking for a password that you know is correct.
The IMAP password is simply the password of your email account — the same one you use for webmail. It cannot be viewed in your mail client or recovered from the server, because it’s stored hashed. If you’ve forgotten it, reset it: for a custom domain email, change it in your hosting control panel (cPanel → Email Accounts → Manage); for Gmail, Outlook.com or Yahoo, use the provider’s account recovery. If you have two-factor authentication enabled, some clients need an app password instead of your normal one.
What is an IMAP password?
There isn’t a special credential called an “IMAP password.” The term just describes the password your mail app sends when it connects to the IMAP server to read your mail — and that’s the password of the email account itself.
So for the address you@yourbusiness.com, the IMAP password is the password set for that mailbox. The same one that logs you into webmail. The same one the SMTP server accepts when you send.
This mirrors how the rest of IMAP works: an IMAP account isn’t a special type of account either — it’s your ordinary email account, accessed through the IMAP protocol. The protocol name gets attached to things that were never protocol-specific, and that’s where the confusion starts.
One important distinction: your email password is not your hosting control panel password. They’re separate credentials for separate systems. Signing into cPanel uses one; reading your mailbox uses the other.
Why you can’t just look it up
People search for how to find their IMAP password, expecting it to be displayed somewhere. It isn’t, and for good reason:
- On the server, it’s hashed. Mail servers don’t store your password as readable text — they store a one-way cryptographic hash. Even the server administrator can’t read it back. That’s a security feature, not an oversight.
- In your mail client, it’s encrypted. Outlook, Apple Mail and Thunderbird save your password locally in an encrypted store so you don’t have to retype it, but they deliberately don’t display it back to you.
That leaves three realistic ways to get a working password:
- Your password manager. If you saved it when setting up the account — in a dedicated password manager, your browser, macOS Keychain or Windows Credential Manager — that’s where a copy lives.
- Test it in webmail. If you think you know the password, sign in to your webmail in a browser — our cPanel webmail login guide covers the three addresses that work. If it works there, it’s the right one, and the problem lies elsewhere in your client’s settings.
- Reset it. The definitive route, and often the fastest. Details below.
It’s worth adding that you also can’t change the server-side password from inside your mail client. Many people hunt through Outlook’s account settings for a “reset password” option that doesn’t exist — the client only stores the credential you give it. Changing the actual password always happens at the source: your hosting control panel, or your provider’s account settings.
How to reset your IMAP password
The method depends on who runs your mailbox.
Email at your own domain (hosting control panel)
This is the simplest case, because you control the mailbox directly — no recovery process, no identity verification:
- Sign in to your hosting control panel — DirectAdmin or cPanel.
- Open Email Accounts (in DirectAdmin, E-mail Manager → E-mail Accounts).
- Find the address and choose the option to change its password.
- Enter the new password and save.
Sign in to your hosting control panel — DirectAdmin or cPanel. Open Email Accounts (in DirectAdmin, E-mail Manager → E-mail Accounts). Find the address and choose the option to change its password. Enter the new password and save.
The new password takes effect immediately. Our guide on how to create an email account in cPanel covers the same screen, which also shows the server settings you’ll need.
Gmail, Outlook.com, Yahoo and other providers
For a free provider, the mailbox password is your account password, so you reset it through that provider’s account recovery — the “forgot password” flow on their sign-in page. You’ll be asked to verify your identity by phone, backup email or another method.
Once reset, the new password becomes your IMAP password automatically. There’s nothing separate to update on the provider’s side.
Once you change the password, every device configured with the old one will keep trying to authenticate and failing — repeatedly, in the background. Beyond the constant password prompts, a stream of failed logins can trigger rate limiting or a temporary block on the account. Update the password on your phone, laptop and any other client right after the reset, not later.
When you need an app password instead
If your provider has two-factor authentication enabled on your account, your regular password may not work in a mail client at all.
Modern clients handle this by opening the provider’s sign-in window and using OAuth — you authenticate there, approve access, and never type a password into the client. When that works, there’s nothing else to do.
But older clients, and some third-party apps, only support the traditional username-and-password method. For those, providers issue an app password: a long, randomly generated credential created specifically for one application, which bypasses the 2FA prompt without weakening your main account. You generate it in your provider’s account security settings and paste it into the mail client in place of your normal password.
Our Hotmail IMAP settings guide walks through how this works for Microsoft accounts, including the caveat that Microsoft has been progressively retiring the older authentication methods.
App passwords solve the sign-in side of email. The sending side is separate — if your messages arrive but land in spam, the cause is SPF, DKIM, DMARC or reputation, and our diagnostic checklist works through them in order.
Why your mail client keeps asking for the password
A repeating password prompt feels like a wrong password, but frequently it isn’t. Work through these in order:
| Cause | What to do |
|---|---|
| Password is genuinely wrong or was changed | Test it in webmail; reset if it fails there too |
| Username is incomplete | Use the full email address, not just the part before the @ |
| IMAP is disabled at the provider | Outlook.com requires IMAP to be switched on in its settings; on Google Workspace an admin can disable it. Personal Gmail no longer has the option — see imap.gmail.com is not responding |
| 2FA requires an app password | Generate one in your account security settings and use it |
| Stale credential cached by the system | Clear the saved entry in Windows Credential Manager or macOS Keychain, then re-enter |
| Outlook set to always ask | In classic Outlook: More Settings → Security → uncheck “Always prompt for logon credentials” |
| Client too old for modern authentication | Update the app, or switch to one that supports OAuth |
| Security software blocking the connection | Antivirus, firewall, proxy or VPN can interrupt the connection and surface as an auth failure — test with them off |
| Wrong server or port, misread as an auth failure | Verify against your control panel — see the correct IMAP settings |
If nothing else works, there’s a safe last resort with IMAP specifically: remove the account from the client and add it again. Because IMAP keeps the master copy of everything on the server, you won’t lose messages — the client simply re-downloads the mailbox. That isn’t true for POP3, where local copies may be the only ones, so check which protocol you’re using before deleting anything.
In classic Outlook, there’s a gentler step to try first: File → Account Settings → Account Settings, select the account and click Repair, which rebuilds the connection without removing anything.
Good practice for email passwords
Since this password protects a mailbox that can be used to reset your other accounts, it deserves better than a reused one:
- Make it long and unique. Length matters more than symbols. Don’t reuse a password from another service.
- Store it in a password manager. That’s the answer to “where do I find my IMAP password” for the future — it should be in a manager, not in your memory.
- Enable two-factor authentication where your provider offers it, and use OAuth-capable clients so it stays convenient.
- Change it if you suspect exposure, and update every device immediately afterwards.
With Copahost hosting, your email lives at your own domain and you reset any mailbox password yourself in cPanel — no recovery queues, no waiting. Full IMAP, POP3 and SMTP support, plus support in your language when you need it.
See hosting plans with emailFrequently asked questions
What is an IMAP password?
It is the password of your email account, used by your mail app when it connects to the IMAP server to read your messages. There is no separate IMAP password to create — it is the same password you use to sign in to your webmail.
How do I find out my IMAP password?
You cannot look it up. The server stores it as a one-way hash and mail clients keep it in an encrypted store without displaying it. If you saved it in a password manager, browser or system keychain, retrieve it there. Otherwise, reset it through your hosting control panel or your provider’s account recovery.
How do I reset my IMAP password?
For email at your own domain, open your hosting control panel, go to Email Accounts, click Manage next to the address and set a new password. For Gmail, Outlook.com, Yahoo and similar providers, use the forgot-password flow on their sign-in page. Then update the new password on every device.
Is the IMAP password the same as my email password?
Yes. They are the same credential. It is not the same as your hosting control panel password, however — those are separate systems with separate logins.
Why does my mail app keep asking for my IMAP password?
Often the password is not the problem. Common causes are using only the part before the @ as the username, two-factor authentication requiring an app password, a stale credential cached by the operating system, a client too old for modern authentication, or incorrect server settings being reported as an authentication failure.
Do I need an app password for IMAP?
Only if two-factor authentication is enabled on your account and your mail client does not support modern OAuth sign-in. In that case, generate an app password in your provider’s security settings and use it in the client instead of your regular password.
What happens if I change my email password?
Every device still configured with the old password will fail to authenticate and keep prompting you. Repeated failed logins can also trigger temporary blocks. Update the password in every mail client immediately after changing it.
Conclusion
The IMAP password is one of those terms that sounds more complicated than it is: it’s just your email account password, doing its job when a mail app connects to the server. You can’t retrieve a forgotten one — hashing on the server and encryption in the client are both working as intended — so the practical path is to reset it, in your hosting control panel if the mailbox is at your own domain, or through your provider’s recovery if it isn’t. Then update every device before the old credential starts failing in the background. And if the prompts keep coming with a password you know is right, look past the password itself: the username, an app password requirement, or a cached credential is usually the real culprit.
