When two-step authentication is enabled for a blog, your primary password generally cannot be used to log in with MarsEdit. Instead, you need to configure a special password, usually called an “application password,” which can be used exclusively by MarsEdit to connect to your blog.

Application passwords can typically be managed in the admin interface for your blog, so that access can be revoked if you decide you no longer want to allow access from a particular application.

See also: WordPress.com Authentication