Why changing the main password is not enough
A common assumption is that resetting your Yahoo password cuts off every device and app. For third-party mail clients that sign in with an app password, that assumption is wrong.
Yahoo app passwords used by third-party applications remain active after the main account password changes. Source
That gap matters because an app password is a separate credential. If you replaced an old phone, retired a desktop mail client, or stopped using a mail app you once set up, the associated app password can keep working even after you have changed the password you type into the Yahoo website. The practical consequence is that the main-password change protects the main sign-in, while each app password has to be dealt with on its own.
This guide covers the specific case of an owner who has already changed their Yahoo password and wants to revoke an older app password used by a third-party mail client. It does not cover recovering a Yahoo account you cannot sign in to, and it does not describe any automatic revocation process, because none is established here.
The deletion path in Account Security
Yahoo provides a direct way to remove an app password from the account rather than relying on the client to stop using it.
An owner can delete an app password from Account Security under External Connections and App passwords, then confirm deletion. Source
In practical terms, the path is:
- Sign in to your Yahoo account and open Account Security.
- Go to External Connections, then App passwords.
- Locate the app password associated with the older third-party mail client.
- Delete that entry, then confirm the deletion when prompted.
The final confirmation step is part of the flow and should not be skipped; a half-finished deletion is not a revoked credential.
What this guide does not establish
This is a checklist based on the reviewed platform claims, not a record of a test performed on a live Yahoo account. The approved facts confirm that the deletion path exists and that app passwords survive a main-password change. They do not establish:
- how quickly a client loses access after deletion, or whether it fails immediately or on its next sign-in attempt;
- whether the client displays an error, silently stops syncing, or keeps showing cached mail;
- any menu wording, screen layout, or list ordering beyond the External Connections and App passwords location;
- any recovery path if you delete the wrong entry.
If the screen you see differs from the steps above, treat the reviewed claim as the anchor — Account Security, External Connections, App passwords — and follow the labels actually shown in your account rather than assuming a layout.
Identify the right entry without guessing who owns it
App password lists typically label entries by device or client name. That label is a description attached when the password was created or used; it is not proof of a person, and it is not a reliable inventory of who has access.
A short checklist for narrowing down the entry:
| Question | Why it helps |
|---|---|
| Which mail clients do I still actively use? | Entries for clients you have retired are candidates for deletion. |
| Did I set up a client on a device I no longer own? | The old device may still be using its app password. |
| Does the label match a client name rather than a person? | Device and client labels describe software, not identity. |
| Am I unsure which entry is which? | Confirm the client’s intended access separately before deleting, for example by checking whether that client is still configured on a device you control. |
If two entries look similar, do not assume the newer-looking one is the one in use. Confirm which client you actually want to keep, then delete the other. If you cannot tell them apart, it is reasonable to delete both and re-create an app password only for the client you still need — but note that the reviewed facts here cover deletion, not the re-creation flow, so check the current screens for that step.
After deletion: what to expect and what to check
Once you have confirmed the deletion, the old app password should no longer be a working credential for that client. What you observe next depends on the client:
- The client asks you to sign in again. This is the expected outcome if it was relying on the deleted app password.
- The client still shows old mail. Cached messages can remain visible even when the account connection is gone; visible mail is not evidence that access persists.
- The client appears to keep working. Do not assume the deletion failed. Some clients retry or hold a session briefly. The reviewed facts do not establish timing, so verify by checking the App passwords list again and confirming the entry is absent.
- You are not sure which client was affected. Check each mail app you still use and confirm it can still reach the account you intend it to reach.
If a client you still need stops working, the fix is to set it up again with a new app password from the same Account Security area. That is a separate action from revocation, and this guide does not claim it will restore access automatically or without the client’s own sign-in steps.
Where a username lookup fits — and where it does not
Revoking an app password is an account-security action performed inside Yahoo. A public-username lookup is a different task: it surfaces public profile candidates that use a given handle. It cannot change Yahoo settings, delete an app password, recover a private account, or confirm who is behind a device label.
That distinction is useful when you are trying to understand your own public footprint after cleaning up account access. If your next question is which public accounts are associated with an email address you control, see review the related account task. Keep the two tasks separate: a public match is a lead to check, not proof of ownership or of who has access to a mail client.
A short recap
- A Yahoo password change does not revoke app passwords used by third-party clients.
- Delete the specific app password in Account Security under External Connections and App passwords, then confirm.
- Treat client and device labels as descriptions, not identity evidence.
- Verify the outcome in the App passwords list rather than inferring it from what the mail client displays.