An app password is a separate password you create for a single mail app, such as "iPhone" or "Thunderbird on the laptop". You type it into that app instead of your main redmail.com password.

Why bother?

• You need one for apps that connect using Exchange, ActiveSync or MAPI once you've turned on two-factor authentication, because those apps can't ask you for a code.
• It limits the damage if a device is lost or stolen. Remove that one app password and only that device stops working. Everything else carries on, and you don't have to change your main password.
• It only works where you allow it. When you create an app password, you choose what it can be used for, such as IMAP and sending mail.
• You can see when it was last used, and from which IP address, so an app password nobody recognises stands out.

An app password can't be used to sign in to webmail.