An app password is a separate code you create for a single program or device, different from your main account password
An app password is a unique password you generate specifically for one process or device to access your account. It is not the same as your regular login password. Instead of giving a program your actual password, you create a temporary code just for that app. If someone steals that code, they only get access to that one program — not your entire account.
Most email providers and cloud services let you generate app passwords when you turn on two-factor authentication. Gmail, Microsoft Outlook, Apple iCloud, and Yahoo Mail all offer this feature. You create the password once, enter it into the app or device, and then you do not have to type it again unless you delete it.
App passwords exist because older programs and devices cannot handle two-factor authentication the way modern apps can. When you enable two-factor authentication on your email account, your phone becomes a second lock — you need both your password and a code from your phone to sign in. But some programs, like older email clients or smart home devices, do not know how to ask for that second code. An app password lets those programs in without weakening your main account security.
Key Takeaways
- An app password is a unique code created just for one program or device, separate from your main account password.
- You generate app passwords through your account settings when two-factor authentication is turned on, and each one works only for the app you create it for.
- If an app password is stolen or leaked, only that single app loses access — your main account and other apps remain protected.
- Older programs and devices that cannot handle two-factor authentication can still access your account securely by using an app password instead of your real password.
How app passwords differ from your main password
Your main password protects your entire account. Anyone who knows it can sign into your email, change your settings, reset other passwords, and access everything you have stored there. That is why it needs to be long, random, and known only to you.
An app password is intentionally limited. It only works for the specific app or device you created it for. If you create an app password for your phone's email app, that code will not work in Gmail on a web browser, in Outlook on your computer, or anywhere else. You can create dozens of different app passwords, each one tied to a different program. If one gets compromised, you straightforward delete it from your account settings, and that program loses access. Your main password stays safe, and every other app keeps working.
This separation also means you do not have to change your main password when you stop using an old device. Instead, you just delete the app password you created for it. The device becomes useless for accessing your account, but your password itself never changes.
When you need to create an app password
You need an app password when you want to use an older program or device with an account that has two-factor authentication turned on. Common situations include setting up email on a phone's built-in mail app, connecting an older email client on your computer, or adding your email to a smart home device or printer.
Modern apps like Gmail's official app or Outlook's official app do not need app passwords. They can handle two-factor authentication directly — when you sign in, they will prompt you for the code from your phone. But if you are using a program that was built before two-factor authentication became standard, or if you are setting up a device that cannot display a web browser, an app password is often the only way forward.
You can also create an app password just to be extra cautious. Some people generate one for each device they own, even if the device could technically handle two-factor authentication. That way, if a device is lost or stolen, they can delete just that device's password without affecting anything else.
How to tell if a program is asking for an app password
When you try to sign into an older program with two-factor authentication turned on, the program will usually reject your main password and tell you to use an app password instead. The error message might say something like "Sign-in was unsuccessful" or "Your password is incorrect," even though you know it is right. That is the signal that you need to create an app password.
Some programs are clearer about it. They might show a link that says "Use an app password" or "Having trouble signing in?" If you click that link, it will explain that you need to go to your account settings and generate one.
If you are not sure whether a program needs an app password, try signing in with your main password first. If it works, you do not need one. If it fails and you have two-factor authentication turned on, then an app password is probably what you need.
The security advantage of using app passwords
App passwords make your account more find in two ways. First, they let you use two-factor authentication without locking yourself out of older programs. Two-factor authentication is one of the strongest protections you can enable, and app passwords let you keep it on everywhere.
Second, they limit the damage if a password leaks. If someone finds an app password written down or stored insecurely on an old device, they can only access that one app. They cannot use it to sign into your email on the web, change your account settings, or access any other service. You can delete that single app password and move on. Your main password stays secret, and all your other devices and programs keep working without interruption.
This is especially valuable if you use the same password across multiple services — which you should not, but many people do. If one service gets hacked and your password leaks, someone could try it on your email, your bank, and everywhere else. But if you use app passwords for each service, a leak at one place only affects that one place.
Managing and deleting app passwords
You can see all your app passwords in your account settings, usually under a section called "Security" or "App Passwords." Each one shows the app or device it was created for and when it was created. You can delete any of them at any time.
If you stop using a device or uninstall an app, delete its app password. This is not urgent — the password will not work anywhere else anyway — but it keeps your account cleaner and reduces the number of old codes floating around. If you ever sell or give away a device, delete its app password before you hand it over.
You can also delete an app password if you think it might have been compromised. If an old device was stolen or if you are not sure whether a password was stored securely, delete it and create a new one. The old password will stop working when ready.
Frequently Asked Questions
Can I use the same app password for multiple devices?
Technically yes, but you should not. Each device should have its own app password. That way, if one device is lost or stolen, you only delete that device's password. If you use the same password on five devices and one gets compromised, you have to delete the password and set up all five devices again.
What happens if I forget an app password?
You cannot recover a forgotten app password — you have to delete it and create a new one. Go to your account settings, find the app password in your list, delete it, and generate a fresh one. Then enter the new password into your app or device.
Do I need an app password if I do not have two-factor authentication turned on?
No. App passwords only exist because two-factor authentication blocks older programs. If you do not have two-factor authentication enabled, you can just use your main password everywhere. But you should turn on two-factor authentication for security, which is why app passwords are useful.
Can someone use an app password to access my account on the web?
No. An app password only works for the specific app or device it was created for. Even if someone has the app password, they cannot use it to sign into your email in a web browser or access any other service.
How many app passwords can I create?
Most providers let you create as many as you need — usually at least 16 to 20. You can create one for each device or app you use. There is no practical limit for most people.