iCloud Mail Security: Two-Factor Authentication and App-Specific Passwords
Secure iCloud Mail with your Apple Account: turn on two-factor authentication, create app-specific passwords for Outlook and Android, and set up a recovery contact or recovery key.
iCloud Mail is protected by your Apple Account, so its security settings are the Apple Account's: two-factor authentication, app-specific passwords for other email apps, and the recovery options that get you back in if you're locked out. All of them are under Sign-In & Security on your iPhone, iPad or Mac.
Two-factor authentication
With two-factor authentication on, signing in on a new device or on the web needs your password and a six-digit verification code. The code appears automatically on your trusted Apple devices, or is sent to your trusted phone number.
- iPhone or iPad: Settings › your name › Sign-In & Security, then turn on two-factor authentication and follow the steps.
- Mac: System Settings › your name › Sign-In & Security.
- Web: sign in at account.apple.com and choose Upgrade Account Security.
Accounts created with two-factor authentication can't turn it off. If you've only just turned it on yourself, you can switch back within two weeks — but there's rarely a good reason to.
App-specific passwords for other email apps
Outlook, Thunderbird and Android email apps can't sign in with your Apple Account password. Either approve them with Apple's sign-in prompt, if the app offers it, or give each one an app-specific password:
- Sign in at account.apple.com.
- Open Sign-In and Security, then App-Specific Passwords.
- Choose Generate an app-specific password and follow the steps.
Two-factor authentication must be on to create them. You can have up to 25 at once, and changing your Apple Account password cancels all of them. Remove access you no longer use under Sign-In and Security › Account Data Sharing (for approved apps) or by revoking the app-specific password.
Set up recovery before you need it
| Option | What it does | Where to set it up |
|---|---|---|
| Recovery contact | Someone you trust who can give you a six-digit code to reset your password. They get no access to your account or data. | Settings › your name › Sign-In & Security › Recovery Contacts (up to five) |
| Recovery key | A 28-character code that, with your trusted phone number and an Apple device, lets you reset your password yourself. | Settings › your name › Sign-In & Security › Recovery Key |
| Trusted phone number | Receives verification codes and helps with recovery. | Sign-In & Security |
A recovery contact needs an Apple device with iOS 15, iPadOS 15 or macOS Monterey or later, iMessage turned on, and to be over 13 (the age varies by country or region). Keep a recovery key somewhere safe: if you lose it, Apple can't give it to you, and you could lose access to your account.
Everyday habits
- Only enter your Apple Account password on Apple devices, icloud.com or account.apple.com — never on a page reached from a link in an email.
- Review your trusted devices and phone numbers now and then, and remove any you no longer have.
- If you forget your password, see resetting your iCloud Mail password; for sign-in problems, signing in to iCloud Mail.
How this guide was checked · October 2026
Verified against 5 official sources
Every step, setting and limit in this guide was checked against the provider’s own documentation on support.apple.com. Anything we couldn’t confirm was left out.
- 01 Apple: Two-factor authentication for Apple Account support.apple.com
- 02 Apple: Sign in to apps using app-specific passwords support.apple.com
- 03 Apple: Set up a recovery contact for your Apple Account support.apple.com
- 04 Apple: Set up a recovery key for your Apple Account support.apple.com
- 05 Apple: Access your iCloud Mail in third-party apps support.apple.com
Questions
Frequently asked questions
How do I turn on two-factor authentication for iCloud Mail?
It's part of your Apple Account: Settings › your name › Sign-In & Security on iPhone or iPad, or System Settings on a Mac.
Where do I get an app-specific password for iCloud?
At account.apple.com under Sign-In and Security › App-Specific Passwords. Two-factor authentication must be on.
What is an Apple recovery contact?
A trusted person who can give you a six-digit code to reset your password. They can't see your account or data. You can add up to five.
What happens if I lose my Apple recovery key?
Apple can't give it to you, and you could lose access to your account. Store it somewhere safe, and replace it if you think it's lost.
Related guides
More iCloud Mail guides
iCloud Mail
How to Stop Spam in iCloud Mail
Report junk in iCloud Mail on every device, rescue real email from Junk, and use Apple’s privacy features to get less spam in the first place.
3 min read
iCloud Mail
How to Set Up an Out-of-Office Reply in iCloud Mail
Set an automatic out-of-office reply in iCloud Mail with dates, turn it off, and avoid the storage problem that stops email arriving while you’re away.
2 min read
iCloud Mail
How to Set Up Rules in iCloud Mail
Rules sort iCloud Mail for you as it arrives. Create, edit, reorder and delete them on iCloud.com, and know the limits.
2 min read
iCloud Mail
How to Recover Deleted Emails in iCloud Mail
Deleted iCloud Mail waits in Trash for 30 days. Move it back on iCloud.com, check Junk, and check the settings that can erase email immediately.
2 min read
iCloud Mail
How to Forward Emails in iCloud Mail (and Automatically)
Forward one iCloud email, or send all your iCloud Mail to another address automatically — with or without keeping a copy.
2 min read
iCloud Mail Troubleshooting
iCloud Mail Not Working? Fixes for Sending and Receiving
iCloud Mail not sending or receiving? Check Apple's status page, iCloud storage, size limits and Push, then device-specific fixes for iPhone, iPad, Mac, iCloud.com and other apps.
3 min read