Photo by James Harrison on Unsplash

A colleague pinged me on Cliq one afternoon saying his Outlook had stopped syncing Zoho Mail and he was getting an "invalid credentials" error. He hadn't changed his password. Hadn't touched any settings. What had changed was that our org admin — me, actually — had enforced two-factor authentication across all accounts the previous night. That was the culprit. And honestly, I felt a little bad because I hadn't warned anyone this would happen.

The thing is, when you enable two-factor authentication on a Zoho account, your regular password stops working for IMAP and SMTP connections. Third-party apps like Outlook, Thunderbird, Apple Mail, or any mobile mail client can't handle the OTP step that TFA requires. So they just fail silently with a bad credentials error. Zoho's solution is app-specific passwords — a separate generated password that bypasses the OTP flow for that one app. It's actually a sensible system once you understand it, but Zoho does a terrible job of explaining this to users when TFA gets turned on.

I've walked at least a dozen people through this now. The fix is genuinely quick once you know where to go, but the security settings in Zoho are buried under enough menus that it's easy to spend 45 minutes clicking around in the wrong places. So here's exactly how to do it.

Table of Contents

• Why Your Password Stops Working After Enabling TFA
• How to Generate an App-Specific Password in Zoho Mail
• Where to Enter the App-Specific Password
• Setting It Up on Android or iPhone Mail Apps
• Common Mistakes That Trip People Up
• Final Thoughts

Photo by Juanjo Jaramillo on Unsplash

Why Your Password Stops Working After Enabling TFA

When two-factor authentication is active, every login to Zoho goes through two steps: your password, then an OTP from an authenticator app or SMS. That works fine in a browser. But IMAP and SMTP protocols are old. They were designed for a single password handshake and nothing more. They have no way to send an OTP. So when Outlook tries to connect using your normal Zoho password, Zoho's servers reject it because the login flow is incomplete from their perspective.

App-specific passwords are basically a workaround Zoho built for this exact scenario. You generate a long random password from inside your account, label it something like "Outlook Desktop", and then use that password only for that app. It works because Zoho treats these passwords as pre-authenticated — they skip the TFA step. You keep TFA active and your account stays secure, but your email clients can still connect. Makes sense, right?

One thing worth knowing: app-specific passwords only appear as an option if TFA is already enabled on your account. If TFA is off, you won't see the option at all. Go to accounts.zoho.in (or accounts.zoho.com depending on your region) and check your security settings first.

Photo by Ilya Pavlov on Unsplash

How to Generate an App-Specific Password in Zoho Mail

This is where most people get lost. The option is not inside Zoho Mail itself. It's in your Zoho account settings, which is a separate portal. Here's the path:

1. Open a browser and go to accounts.zoho.in (Indian users) or accounts.zoho.com
2. Sign in with your Zoho credentials and complete the TFA step
3. In the left sidebar, click Security
4. Scroll down to the section called App Passwords — it's below the TFA section, not above it
5. Click Generate New Password
6. Give it a name that describes the app you're setting it up for — something like "Outlook Laptop" or "Thunderbird Office"
7. Click Generate
8. Copy the password immediately. Zoho shows it only once. Once you close that dialog, it's gone and you'd have to generate a new one

The generated password looks something like xxxx-xxxx-xxxx-xxxx — a 16-character string with dashes. That's your app-specific password. Treat it like a real password. Don't put it in a shared doc or paste it into Slack.

Where to Enter the App-Specific Password in Desktop Clients

For Outlook on Windows or Mac, go into your account settings and find the Zoho account. When it asks for your password, delete whatever is saved there and paste the app-specific password instead. Use these IMAP and SMTP settings alongside it:

• IMAP server: imappro.zoho.in (India) | Port: 993 | SSL: Yes
• SMTP server: smtppro.zoho.in (India) | Port: 465 | SSL: Yes
• Username: your full Zoho email address

For Thunderbird, go to Account Settings > Server Settings and update the password there. Thunderbird sometimes caches the old password aggressively, so you might need to go into the OS credential manager and delete the saved Zoho entry before Thunderbird picks up the new one.

If you're on the zoho.com region instead of zoho.in, use imappro.zoho.com and smtppro.zoho.com instead. Getting the region wrong is a very common reason the setup fails even with a correct app password.

Setting It Up on Android or iPhone Mail Apps

On Android — whether you're using the built-in Samsung Mail, Gmail app in manual IMAP mode, or something like Aqua Mail — go to the account settings for your Zoho account and just replace the existing password with the app-specific password. Same server settings as above apply.

On iPhone using the native Mail app, go to Settings > Mail > Accounts > your Zoho account > Account > Password and update it there. iOS sometimes won't prompt you again if the old password is cached, so you may need to delete the account and re-add it using the app password from scratch. Annoying, but faster than debugging why it won't update.

The Zoho Mail native app for Android and iOS doesn't need an app-specific password at all — it handles TFA through the proper OAuth flow. This whole setup is only needed for third-party clients connecting via IMAP and SMTP.

Common Mistakes That Trip People Up

Using the wrong regional portal. Indian Zoho accounts should generate passwords at accounts.zoho.in and use imappro.zoho.in for IMAP. Using the .com server with a .in account — or vice versa — causes connection failures that have nothing to do with the password itself.

Not copying the password immediately. Zoho shows it once. If you click away, you need to generate a new one. I've seen people generate three passwords in a row because they kept losing the first two.

Using the app password to log into Zoho's web interface. It won't work. App-specific passwords are only for IMAP and SMTP. Your regular password plus OTP is still what you use for browser login.

Forgetting to revoke old app passwords. If a laptop gets replaced or an account gets handed over, go back to Security settings and revoke the app password for that device. You can have multiple app passwords active at once, so it's easy for these to pile up.

Generating one password and using it everywhere. Technically it works, but it's bad practice. If one app is compromised, you'd have to regenerate the password and update every other app too. One password per app is the right way.

Final Thoughts

Honestly, this is one of those things that should take five minutes but ends up taking an afternoon the first time. Zoho's documentation exists but it's scattered, and the error messages from Outlook or Thunderbird don't point you toward app passwords at all — they just say wrong credentials and leave you guessing.

Once you've done it once, though, it clicks. And it's actually a better setup than leaving TFA off just to make Outlook happy. Your account stays protected, your email clients keep working. That's the outcome you want. If you're an admin rolling out TFA org-wide, do your team a favor and send them this before you flip the switch — not after they start raising tickets.