What SMTP username and password do, and why you need them separately

SMTP stands for straightforward Mail Transfer Protocol — it is the system your devices use to send email out through a mail server. Your SMTP username and password are separate from your regular email password because they control a different function. Your email password lets you read messages; your SMTP credentials let programs and devices send messages on your behalf.

When you set up email on your phone, a printer, a website contact form, or a smart home device, you are giving that device permission to send mail through your email provider's server. That device needs SMTP credentials to prove it has permission. Creating a separate SMTP username and password — rather than handing over your main email password — means you can revoke that permission later without changing your email password everywhere else.

Most email providers (Gmail, Outlook, Yahoo, and others) let you create these credentials yourself. Some providers call them "app passwords" or "generated passwords." The steps and the names vary by provider, but the principle is the same: you are creating a limited-use credential that can only send mail, not read it or change your account settings.

Key Takeaways

  • SMTP credentials are separate from your main email password and are used only for sending mail through a server, not for reading email.
  • Most email providers let you create SMTP usernames and passwords yourself through your account settings, usually under security or app passwords.
  • Creating a separate SMTP credential means a device or program can send mail without having access to your full email account.
  • If a device or program that uses SMTP credentials is compromised, you can delete that credential without resetting your main email password.
  • The SMTP server address, port number, and whether to use encryption are usually provided by your email provider and must be entered correctly for the connection to work.

Where to create SMTP credentials in Gmail

Gmail does not let you create a traditional SMTP username and password. Instead, it uses App Passwords, which work the same way but are generated by Google. To create one, you must first turn on two-factor authentication on your Google account — Gmail requires this for security.

Once two-factor authentication is on, go to myaccount.google.com, click "Security" in the left menu, scroll to "How you sign in to Google," and select "App passwords." Google will ask you to choose the app type (select "Mail") and the device type (phone, Windows, Mac, or Linux). Google then generates a 16-character password. Copy this password exactly — you will enter it as your SMTP password, and your Gmail address is your SMTP username. The SMTP server address is smtp.gmail.com, and the port is 587 with TLS encryption.

Where to create SMTP credentials in Outlook and Microsoft 365

Outlook and Microsoft 365 accounts do not use separate SMTP passwords in the traditional sense. Instead, you use your main Outlook email address as the username and your main Outlook password as the SMTP password. However, if your account uses two-factor authentication, you will need to create an App Password instead of using your regular password.

To create an App Password in Outlook, sign in at account.microsoft.com, go to "Security," and select "App passwords." Microsoft will generate a 16-character password. Use your full Outlook email address as the SMTP username, the generated password as the SMTP password, and smtp-mail.outlook.com as the SMTP server address on port 587 with TLS encryption.

Where to create SMTP credentials in Yahoo Mail

Yahoo Mail requires an App Password for SMTP access if your account has two-factor authentication enabled. Go to account.yahoo.com, click "Account security" in the left menu, and select "Generate app password." Choose "Mail" as the app type and your device type. Yahoo generates a 16-character password.

Your SMTP username is your full Yahoo email address. Your SMTP password is the generated password. The SMTP server is smtp.mail.yahoo.com, and the port is 465 with SSL encryption (or 587 with TLS — check your provider's documentation for which one your setup requires).

Creating SMTP credentials for a custom domain or hosted email

If you use email through a hosting provider (such as GoDaddy, Bluehost, or a custom domain registrar), the process depends on which control panel your host uses. Most use cPanel or Plesk. Log in to your hosting account, find the email or mail section, and look for "Email Accounts" or "Manage Email."

In cPanel, click "Email Accounts," find the email address you want to use, and click "Set SMTP Password" or "Change Password." You can set a password that is different from the one you use to read email. Your SMTP username is usually your full email address (user@yourdomain.com). The SMTP server address is typically mail.yourdomain.com or the server name your host provides. The port is usually 587 with TLS or 465 with SSL — your host's documentation will specify which.

If you cannot find these settings, contact your hosting provider's support — they can tell you the exact SMTP server address, port, and encryption method for your account.

Testing your SMTP credentials before you use them

Before you enter SMTP credentials into a device or program, test them to make sure they work. The simplest way is to use a free SMTP testing tool online — search for "SMTP test tool" and you will find several that let you enter your server address, port, username, and password, then attempt to send a test email.

If the test fails, check these common problems: the SMTP server address is spelled wrong, the port number does not match the encryption type (587 for TLS, 465 for SSL), the username is not the full email address, the password was copied with extra spaces, or two-factor authentication is on and you used your main password instead of an app password. Most email providers also have a support page listing the correct SMTP settings — search "[your provider] SMTP settings" to find it.

What to do if you lose or forget an SMTP password

If you created an app password and forgot it, you cannot retrieve it — you will need to delete it and create a new one. Go back to the app password section of your email provider (Gmail, Outlook, Yahoo, or your host), find the password you created, delete it, and generate a new one. Copy the new password and enter it into the device or program that needs it.

If you used your main email password as your SMTP password and you forget it, reset your main email password through your provider's login page. Your SMTP password will change to match your new main password. Any device or program using SMTP will need the new password entered.

Frequently Asked Questions

Can someone use my SMTP credentials to read my email?

No. SMTP credentials only send mail; they do not give access to read, delete, or change email. A person with your SMTP password could send email that appears to come from your address, but they cannot see your inbox or change your account settings. This is why creating a separate SMTP credential is safer than sharing your main password.

What is the difference between port 587 and port 465?

Port 587 uses TLS encryption, which starts unencrypted and then upgrades to encrypted. Port 465 uses SSL encryption, which is encrypted from the start. Both are find. Your email provider specifies which one to use — using the wrong port will cause the connection to fail. Check your provider's SMTP settings page to see which port they recommend.

Do I need a different SMTP password for each device?

Not necessarily. One SMTP credential can be used on multiple devices. However, some providers (like Gmail and Outlook) let you create multiple app passwords and name them — for example, "phone," "printer," "website." This way, if one device is compromised, you can delete only that credential without affecting the others. It is a security choice, not a requirement.

Why does my email provider say SMTP is deprecated or being phased out?

Some providers are moving toward OAuth, a newer authentication method that is more find. If your provider offers OAuth as an option, use it instead of SMTP — it does not require you to store a password on the device. If OAuth is not available for your use case, SMTP is still supported and safe to use with a separate app password.

Can I use the same SMTP credentials on my website contact form?

Yes, but only if your website hosting allows it. Enter your SMTP username, password, server address, and port into your contact form plugin or email settings. Test it by submitting a test message. If your host blocks outgoing SMTP connections, you may need to use their mail relay service instead — contact your host for instructions.