Nevermore signs in to Yahoo Mail over IMAP with an app password: a separate,
revocable password that works for one app and nothing else. Your ordinary
account password will not work, and that is deliberate — there is no OAuth
consent screen and no third party in the middle. Covers @yahoo.com, @ymail.com, and @rocketmail.com addresses.
Creating one
- Sign in to your Yahoo Account Security page.
- Under External connections, choose Create app password.
- Follow the prompts, then copy the password Yahoo generates.
Yahoo decides whether your account is eligible to create one, and support cannot override that. Their advice: use a browser you have signed in to Yahoo with on several days, and not a private or Incognito window. Changing your main Yahoo password does not invalidate an app password — to revoke one you have to delete it.
Yahoo's own instructions →
Then, in Nevermore
Paste it into the App password field on Nevermore's sign-in
screen. Spaces are fine — the app strips them. It goes straight into the macOS
Keychain, is never written to disk in the clear, and never leaves your Mac.
An app password is a credential: it grants access to your mailbox. Put it in
Nevermore's password field, and nowhere else — not into a note, an email to
yourself, or a chat window. If you ever want to cut Nevermore off, delete the
app password at your provider; nothing else about your account changes.
If sign-in still fails
- Check you entered the app password, not your normal account password. Providers reject both with the same error, so the message looks identical.
- Most providers show the password only once and cannot show it again. If you did not copy it, delete that one and create another — they are free and disposable.
- If you deleted the password at your provider, or changed something about the account, create a new one and re-enter it.
- Still stuck? Get in touch — include your provider and what the error said.
Checked against Yahoo's own instructions on 22 August 2026. Providers move these
settings without warning; if what you see does not match, their page is the
authoritative one and we would be glad to
hear about it.