Can Not Authenticate To IMAP Server

This error means your IMAP client connected to the mail server but the server rejected the credentials during the LOGIN or AUTHENTICATE exchange. In the IMAP protocol this surfaces as a tagged NO response, and modern servers tag it with the [AUTHENTICATIONFAILED] response code defined in RFC 5530 — "Authentication failed for some reason on which the server is unwilling to elaborate. Typically, this includes 'unknown user' and 'bad password'." A raw session looks like:

a1 LOGIN user@example.com hunter2
a1 NO [AUTHENTICATIONFAILED] Invalid credentials (Failure)

What causes "Can Not Authenticate To IMAP Server"?

The connection (TCP + TLS) succeeded, so this is a credential/auth-method problem, not a network problem. The common causes:

• Wrong username or password. The most literal cause per RFC 5530 — bad password or unknown user. Note the username is usually the full email address.
• You used your normal password where the provider now requires an App Password or OAuth2. This is the dominant cause today. Google removed Less Secure Apps access for personal Gmail accounts on May 30, 2022 — a clean, single cutover. Google Workspace accounts went through a separate, messier, repeatedly-delayed shutdown of password-based IMAP/CalDAV/CardDAV/POP/SMTP access: the admin console toggle was removed around mid-2024, a cutover originally planned for September 30, 2024 was paused, then rescheduled to March 14, 2025, and finally pushed to a hard deadline of May 1, 2025. So a plain account password is rejected even when it's correct, and depending on when you're reading this, a Workspace account could have lost access anywhere from mid-2024 through May 1, 2025 — don't assume a single date. Microsoft has similarly retired Basic Authentication for IMAP in Microsoft 365 (fully disabled in all tenants; see Microsoft's deprecation notice for the October 1, 2022 cutover).
• No 2-Step Verification. Google only lets you generate an App Password after 2-Step Verification is enabled. (Google: Sign in with App Passwords — note Google's own page calls this a "16-digit passcode," though the value is actually alphabetic, e.g. abcd efgh ijkl mnop.)
• OAuth2 token expired or wrong format. If you authenticate with XOAUTH2, an expired access token or a malformed SASL string yields the same NO [AUTHENTICATIONFAILED].
• Connecting without TLS / wrong host or port. Some servers refuse plaintext auth and return an auth failure. Use imap.gmail.com:993 (implicit TLS) or a STARTTLS-on-143 setup.

Note: The legacy "enable Less Secure Apps" advice is obsolete. Google removed that toggle for personal accounts in 2022, and Workspace's own equivalent access was phased out on a delayed, multi-stage timeline that concluded May 1, 2025. Do not look for a "less secure apps" switch — it no longer exists on either account type.

How do I fix "Can Not Authenticate To IMAP Server"?

1. Verify the host, port, and TLS. For Gmail/Workspace use imap.gmail.com, port 993, SSL/TLS on. Confirm you can reach it:

openssl s_client -connect imap.gmail.com:993 -crlf
# then: a1 LOGIN you@gmail.com your-app-password

2. For Gmail / Google Workspace — use an App Password or OAuth2:

• Enable 2-Step Verification on the Google account.
• Generate a 16-character App Password (Google Account → Security → App Passwords) and use it in place of your password. Strip the spaces when pasting it. (Google support)
• For server-to-server integrations, prefer OAuth2 / XOAUTH2 per Google's IMAP XOAUTH2 protocol docs. Make sure the access token is fresh — refresh it before it expires.

3. For Microsoft 365 / Outlook.com — use OAuth2. Basic Auth for IMAP is disabled in all Exchange Online tenants (see Microsoft's Basic Authentication deprecation notice); configure modern auth (OAuth2) as described in Microsoft's OAuth IMAP/POP/SMTP guide.

4. Re-issue credentials after a password change. Google revokes App Passwords when the account password changes — generate a new one. The same applies after enabling 2FA.

5. Distinguish auth failure from a server outage. If the server returns [UNAVAILABLE] instead of [AUTHENTICATIONFAILED] (RFC 5530), the backend auth subsystem is temporarily down — retry later rather than changing credentials.