Creating an app-specific password for iCloud Mail

Two minutes at account.apple.com, and you only do it once.

Nevermore signs in to iCloud Mail over IMAP with an app-specific password: a separate, revocable password that works for one app and nothing else. Your ordinary account password will not work, and that is deliberate — there is no OAuth consent screen and no third party in the middle. Covers @icloud.com, @me.com, and @mac.com addresses, and any custom domain you have added to iCloud Mail.

Creating one

Sign in to your Apple Account at account.apple.com. Your account must be protected with two-factor authentication.
In the Sign-In and Security section, select App-Specific Passwords.
Select Generate an app-specific password, then follow the steps on screen.
Copy the password Apple shows you.

Apple calls this an app-specific password, never an "app password" — that is the wording to look for on the page. Your ordinary Apple Account password will not sign in over IMAP.

Apple's own instructions →

Then, in Nevermore

Paste it into the App password field on Nevermore's sign-in screen. Spaces are fine — the app strips them. It goes straight into the macOS Keychain, is never written to disk in the clear, and never leaves your Mac.

An app password is a credential: it grants access to your mailbox. Put it in Nevermore's password field, and nowhere else — not into a note, an email to yourself, or a chat window. If you ever want to cut Nevermore off, delete the app-specific password at your provider; nothing else about your account changes.

If sign-in still fails

Check you entered the app-specific password, not your normal account password. Providers reject both with the same error, so the message looks identical.
Most providers show the password only once and cannot show it again. If you did not copy it, delete that one and create another — they are free and disposable.
If you deleted the password at your provider, or changed something about the account, create a new one and re-enter it.
Still stuck? Get in touch — include your provider and what the error said.

Checked against Apple's own instructions on 22 August 2026. Providers move these settings without warning; if what you see does not match, their page is the authoritative one and we would be glad to hear about it.