Thunderbird seems to have replaced my login password for comcast.net with a bogus, several hundred character long password.

This is normal. Comcast uses OAuth2 for security, and what is stored in your password vault is not the password, but what's known as an "Access Token" which indicates that you have been authorized, in this case, by supplying your password.

Here's a technical explanation of OAuth2:

https://auth0.com/intro-to-iam/what-is-oauth-2

and here:

https://www.digitalocean.com/community/tutorials/an-introduction-to-oauth-2

Most major email providers such as Gmail, Yahoo, and Microsoft use OAuth2, which is more secure than the older password-only protection. Comcast silently introduced Oauth2 sometime in the past couple of years, but hasn't required it - you could use either method. But maybe they are now. And Thunderbird, when it sets up a new account, will set it up to use OAuth2.

Hi Lin,

Thanks for the quick response. I have read your links about OAuth2, and it makes sense,

But the main problem still persists. That is, I am not seeing any emails after 5/23/26 in Thunderbird, even though there are a lot of emails after that date in my webpage access to comcast.net.

Any suggestions about what I may be overlooking?

thanks, Tom

I think you need to initiate the OAuth2 authorization process afresh. First verify that you have the correct server settings. I will assume you are using IMAP rather than POP3. Here are my settings for comparison:

IMAP (Incoming): Incoming Server Type: IMAP Mail Server Incoming Server Name: imap.comcast.net Port: 993 User Name: <my email address> Connection Security: SSL/TLS Authentication method: OAuth2 (Normal Password used to work and may still)

SMTP (Outgoing): SMTP Server Name: smtp.comcast.net Port: 465 Connection Security: SSL/TLS Authentication method: OAuth2 (Normal Password used to work and may still) User Name: <my email address>

=====

To force a re-authorize:

- Make sure cookies are allowed (<Settings | Privacy & Security | Web Content | Accept cookies from sites>);

- Delete all cookies for that account (<Settings | Privacy & Security | Web Content | Show Cookies>);

- Delete all passwords for that account from saved passwords (<Settings | Privacy & Security | Passwords | Saved Passwords>);

Now restart Thunderbird. You will be asked for your credentials, and hopefully they will be accepted and mail retrieval will resume.

I accidentally made this an answer. It was not. Refactored as a question.

Hmmm. I am trying to ask a similar question - this support forum seems to want it to be a "reply" which also looks like an "answer". It is a refined question. Sorry for the confusion.

!-----------

I have a similar problem. I tried the sequence from Lin (6/22/2026) but it did not work for me. I would really like to fix this.

I have an Xfinity/Comcast eMail. It moved to Yahoo. I set that up - with IMAP - and with a strong password - and it has been working fine. I decided it would be smart to use an "app password" for Thunderbird and a different password + MFA for interactive/web sessions. I generated an app-password at Yahoo (web) to use with Thunderbird. So far so good.

I think the idea is to use my interactive password + MFA when I hit my Comcast mail on the Yahoo Mail webpage, but that Thunderbird will use the app-password with no MFA when it does IMAP.

I think what I need to do is get Thunderbird to forget the interactive password, try to connect, have it ask me for my "password", and give it the app-password. But I cannot make that happen. I followed the 3 step process from Lin above to get Thunderbird to ask me for my "password" but it does not work for me. When I do that, I get the splash page from Yahoo, and that page will not accept the app-password - just the interactive password. Then it logs me in. Thunderbird itself *never* asks for my password giving me a chance to put in the app-password.

Or - is it possible that Thunderbird - after this process - *is using* the app-password - and that the splash page solution allows Thunderbird to get the app-password from Yahoo? I can't tell what password Thunderbird is using - but I know it has never asked me to put in a new password itself (where I would put in the app-password from Yahoo).

Any help welcome. Thank you. Thunderbird is a great product and I donate to its support.

PS: I bet if I delete the Comcast/Xfinity/Yahoo account from Thunderbird and just start over and initially put in the app-password that would work. But it seems like overkill and risky - I just need Thunderbird to fully forget my interactive password - which it is stubbornly storing somewhere - and ask me for my password again and I'll give it the app-password. I'll likely try risking that if I/we cannot figure this out.