Why app passwords and not OAuth2 "sign in with Google/Microsoft"?
PikuMail connects to your provider using standard email protocols (IMAP/SMTP) and your own app password. It does not offer the OAuth2 "one-click sign in" that some other apps have, and here is why:
OAuth2 costs a lot for small apps. Google and Microsoft require an app to go through a paid security review/validation before it can use the "Sign in with Google/Microsoft" button for real users. These review processes carry fees, which are too expensive for a small, free, donation-funded project like PikuMail.
Microsoft doesn't support sending mail over IMAP with OAuth for third-party apps the way it does for its own clients, which makes the "quick login" unreliable for sending.
Microsoft does not provide app passwords for all accounts (for example, accounts with two-step verification on some Microsoft plans), so a single sign-in method can't work for everyone.
An app password works with virtually every provider and every plan, keeps your main password safe, and is the simplest, most reliable way to connect. Your password is stored only on your own device — never on any server.