App passwords, provider by provider.

IMAP, POP and SMTP were designed decades before two-factor authentication. They can send a username and a password, and nothing else — there's no way for a mail app to show you a verification code prompt mid-connection. So when providers switched two-factor on, every mail app broke.

An app password is the workaround: a long, random, single-purpose password that stands in for your real one. Because it belongs to one app, you can revoke it without changing your account password, and because it's random it's useless to anyone who steals it from a phishing page.

The modern answer is OAuth instead — the mail app opens the provider's real login page in a secure window, you sign in there (two-factor and all), and the app receives a token rather than a password. That's why Google, Microsoft and others now push OAuth and treat app passwords as a legacy fallback. BlueMail supports OAuth sign-in for the major providers, so for most accounts you never touch an app password at all.

Two habits save a lot of frustration. Note which provider you're on: several ISPs hand their mail to Yahoo or Google, so the credential you need may come from a completely different company than the one that sold you the address. And remember that some providers revoke every app password when you change your account password — if all your devices stop syncing on the same day, that's usually why.