“Authentication failed” means the mail server looked at the username and password your app sent and refused them. That’s it. The server isn’t down, your internet is fine, and the message has nothing to do with your emails themselves.

The confusing part is that this appears constantly on accounts where the password is completely correct. That’s not a contradiction — it’s the most common version of the problem. Google, Microsoft, and Yahoo have all spent the last few years switching off the old way of logging in, and any app still using it gets rejected regardless of whether the password is right.

So before you reset anything: if you have two-factor authentication on that account and you’re setting up a mail app, you almost certainly need an app password, not your regular one. Skip to that section if that describes you.

Why a correct password gets rejected

Six causes cover nearly every case.

The password changed somewhere else. You reset it on your laptop three weeks ago and your phone has been quietly failing ever since. Mail apps cache credentials and only complain when they next try to sync.

Two-factor authentication is on and the app can’t handle it. Your mail client sends a username and password. The server wants a second factor. There’s no way to prompt for it inside a basic IMAP connection, so the whole attempt fails. The answer is an app-specific password.

Basic authentication has been turned off. Microsoft disabled basic auth for Exchange Online across all tenants. Google removed “less secure app access” for Gmail. Both providers now require OAuth. Old apps that only speak the old protocol get a flat rejection.

IMAP or POP is disabled on the mailbox. Microsoft 365 admins can switch these protocols off per-user, and many do as a security baseline. The account works perfectly in Outlook and on the web, and fails in every third-party client.

Wrong server settings. The right password sent to the wrong hostname or port produces the same generic error. Providers vary and autodiscover sometimes guesses badly.

The account is locked. After enough failed attempts — often from a device you forgot was configured, retrying every few minutes — the provider locks the account. Now even the correct password fails until the lockout clears or you unlock it manually.

Generating an app password for Google

Required for any Gmail account with 2-Step Verification that you want to use in Outlook, Apple Mail, Thunderbird, a scanner, or any device that isn’t a Google app.

• Go to myaccount.google.com/security
• Confirm 2-Step Verification is on. App passwords don’t exist without it — if you don’t see the option, this is why
• Go to myaccount.google.com/apppasswords directly, or search “App passwords” in the account search bar
• Type a name you’ll recognise later — “Outlook desktop”, “Front office scanner”
• Click Create. You get a 16-character string in four groups
• Paste that into your mail app’s password field instead of your Google password. Spaces don’t matter

Google shows the password once. Copy it before closing. If you lose it, delete that entry and generate a new one — no harm done.

Google Workspace admins can block app passwords org-wide, in which case the page won’t appear for your users and the client needs to support OAuth instead.

Gmail server settings, while you’re there:

Also check that IMAP is switched on at all: Gmail web > gear icon > See all settings > Forwarding and POP/IMAP > Enable IMAP.

Generating an app password for Microsoft

The process differs depending on account type, and that trips people up.

Personal accounts (outlook.com, hotmail.com, live.com)

• Go to account.microsoft.com/security
• Select Advanced security options
• Under App passwords, choose Create a new app password
• Copy the generated string and use it as the password in your mail client

Two-step verification must be enabled first — same rule as Google.

Work or school accounts (Microsoft 365)

Users go to mysignins.microsoft.com/security-info, click Add sign-in method, and choose App password.

If that option isn’t listed, your administrator hasn’t enabled it. In the Microsoft Entra admin center under Protection > Authentication methods > Policies, app passwords must be permitted for the relevant users. Many tenants leave it off deliberately, because a genuinely modern client doesn’t need one.

Microsoft 365 server settings:

Admins can confirm whether IMAP is even enabled for a user by running, in Exchange Online PowerShell:

Get-CASMailbox -Identity user@yourcompany.com | fl ImapEnabled,PopEnabled

If ImapEnabled is False, that alone explains the failure and no password will work.

Set-CASMailbox -Identity user@yourcompany.com -ImapEnabled $true

“Cannot Get Mail — authentication failed” on iPhone

Apple’s Mail app produces this repeatedly, sometimes several times a day, often after a password change or an iOS update.

Re-enter the password properly

Settings > Apps > Mail > Mail Accounts (on older iOS: Settings > Mail > Accounts), tap the account, tap the account name again to open details, then tap the Password field and retype it. Tap Done and wait for verification.

iOS sometimes displays a saved password that no longer works while showing dots as if it’s populated. Clear the field completely first.

Delete and re-add the account

More reliable than fighting the existing entry. Settings > Apps > Mail > Mail Accounts > tap the account > Delete Account. Then Add Account and pick the provider from the list rather than choosing Other — selecting Google or Microsoft by name triggers the proper OAuth browser sign-in, which handles MFA correctly and needs no app password at all.

For IMAP accounts, deleting the account removes only the local cache; the mail is on the server. For a POP account, check before deleting.

If it keeps recurring

Intermittent authentication failures that clear on their own and come back usually mean the server is throttling the connection, not rejecting the password. Increase the fetch interval: Settings > Apps > Mail > Mail Accounts > Fetch New Data — switch that account from Push to Fetch every 30 minutes and see whether the errors stop.

Also try toggling Airplane Mode on and off, and test on cellular data instead of Wi-Fi. If it works on cellular, something on your office network — a firewall or content filter — is interfering with the mail connection.

Outlook desktop

Outlook has its own credential cache, separate from Windows, and it can hold a stale password indefinitely while insisting the one you type is wrong.

Clear it: Control Panel > Credential Manager > Windows Credentials. Look for entries beginning MicrosoftOffice16_Data: and any referencing your mail server. Expand each and click Remove. Restart Outlook and sign in fresh.

If the prompt keeps returning, rebuild the mail profile. Control Panel > Mail (Microsoft Outlook) > Show Profiles > Add. Create a new profile, let autodiscover configure it, set it as default. A new profile picks up modern authentication automatically, which is frequently the entire fix on a machine that’s been in service for years.

One more registry-level cause worth knowing: some machines have modern auth disabled through an old policy key. Check HKEY_CURRENT_USERSoftwareMicrosoftOffice16.0CommonIdentity for a value named EnableADAL. If it exists and is set to 0, that’s forcing basic auth. Delete the value or set it to 1, then restart.

Yahoo and other providers

Yahoo requires an app password for every third-party client — no exceptions, and it’s been that way for years. Sign in at Yahoo, go to Account Info > Account Security > Generate app password, name it, and use the generated string.

Yahoo IMAP is imap.mail.yahoo.com port 993 SSL; SMTP is smtp.mail.yahoo.com port 465 SSL.

For a mailbox hosted by your web host or domain registrar, get the settings from their control panel rather than guessing. A common trap: the hostname is often mail.yourdomain.com, but the SSL certificate on the server is issued for the host’s own domain, so strict certificate checking rejects the connection. Using the host’s actual server name — something like mail.hostingprovider.net — resolves it.

When it’s the whole office

One person failing to authenticate is a user problem. Everyone failing at once is an account or policy problem, and the causes are short:

• Subscription lapsed — an expired credit card suspends the tenant and every mailbox with it
• A conditional access policy was applied that blocks legacy clients or unmanaged devices
• Basic auth was disabled tenant-wide on schedule
• Someone changed the domain’s MX or autodiscover records
• A provider-side outage — check the Microsoft 365 admin center service health page or Google Workspace status dashboard before troubleshooting anything

Common questions

What does “authentication failed” actually mean?

The server received your credentials and rejected them. It’s a login refusal, not a network or delivery problem. The credentials might be wrong, or they might be right but sent using a method the server no longer accepts — which is why the message appears so often on accounts with a perfectly valid password.

What’s the difference between an app password and my real password?

An app password is a long random string that works for exactly one application and bypasses the two-factor prompt. Your real password still protects the account everywhere else. The advantage is containment: if a device is stolen or an old app is compromised, you revoke that one app password and nothing else is affected. It also can’t be used to sign into the web interface or change account settings.

Why did this suddenly start after years of working fine?

Almost always a provider-side change rather than anything you did. Microsoft and Google have been retiring basic authentication in stages, and each tenant gets switched over on its own schedule. Your setup didn’t change — the rules did. The fix is either updating the client to one that supports OAuth, or generating an app password.

Should I turn off two-factor authentication to make this easier?

No. Email accounts are the master key to everything else you own — every password reset link lands there. MFA is the single most effective control against account takeover, and app passwords exist precisely so you don’t have to choose. Ten minutes generating app passwords beats explaining a business email compromise to your clients.

My account keeps locking. How do I find what’s causing it?

Something is retrying an old password on a loop. Common culprits: an old phone in a drawer, a tablet, a scanner or copier configured to email scans, a CRM or invoicing tool with saved SMTP credentials, or a former employee’s device. Check the sign-in logs for the source IP and user agent. Then either update or remove the offending configuration — resetting the password again just restarts the cycle.