App passwords: what they are and why they are safer
An app password is a long, randomly generated password that you create for one app or device, such as the mail app on your phone, and use instead of your main password. Services offer them once you turn on two-step sign-in, because many mail apps cannot ask for a code. App passwords are safer than typing your main password into every device: the main password stays off the device, and you can cancel one device's access without disturbing the rest. This article explains how they work, where they are weaker, and the step most people forget.
The prompt that confuses people
You do the right thing and turn on two-step sign-in for your email. Then your phone's mail app, or the mail program on your computer, stops working and the provider tells you to create an "app password". The reason is simple. Two-step sign-in asks for a second thing, such as a code from your phone. Many mail apps use the long-established IMAP and SMTP standards, which have no step for that code. An app password is the bridge.
What an app password is
Google, Apple and Microsoft all describe app passwords the same way:
- A long, random password generated by the service, not one you choose. Google's are 16 characters, shown only once.
- Available only once two-step sign-in is on.
- One per app or device. Apple stresses that this way the app never receives your main password.
- Used in place of your main password in that one app.
Some mail servers add a useful refinement. Mailcow, an open-source mail server, lets each app password be limited to particular services, such as receiving mail (IMAP), sending it (SMTP) or calendars and contacts, and switched off or deleted on its own.
Why it is safer than your main password
- Your main password stays off your devices. If a phone is stolen or a computer is infected, the thief gets a password for one app, not the password that controls your whole account.
- You can cancel one device at a time. Lose a phone, and you delete that phone's app password. Your computer and tablet carry on working, and you do not have to change your main password everywhere.
- It cannot be guessed or reused. It is random, and it exists nowhere else, so a password leaked from another website does not unlock your mail.
Where it is weaker
An app password is a deliberate exception to two-step sign-in. Whoever holds it can use the services it allows without a second factor. Google calls the apps that need them "less secure" and recommends signing in through the provider instead wherever an app supports it (see below).
So treat each app password like a key:
- Let your mail app store it, or keep it in a password manager. Do not write it on a note stuck to the screen.
- Do not reuse one app password across several devices.
- Remember that malware on a device can steal stored passwords, app passwords included. Our article on infostealer malware explains how.
Name them, and give them only what they need
Create one app password per device and name it clearly, for example "Phone, mail app" or "Office PC, Thunderbird". When you look at the list in six months, you will know which one to remove. Where the service lets you limit an app password to particular services, give a mail app access to mail only.
Revoking: the step people forget
Delete an app password when:
- a device is lost, stolen, sold or replaced;
- a staff member leaves;
- you stop using an app;
- you suspect any account compromise.
Do not assume that changing your main password removes them. It depends on the service. Google and Apple revoke all app passwords when the account password changes. Microsoft says the opposite for Microsoft 365 business accounts: app passwords are not revoked when you reset the password, and have to be deleted separately. After any suspected compromise, delete every app password explicitly and create new ones only for the devices you still use.
Better still: signing in through your provider
Some mail services and apps support OAuth, the "Sign in with..." flow. Instead of storing a password, the app opens your provider's own sign-in page, where you complete two-step sign-in as normal, and receives a token it can use for mail. Mozilla explains that with OAuth, Thunderbird never stores your password, only this token. Where both your provider and your app support it, Google recommends this over app passwords.
Noiz recommends Thunderbird for email. Our help articles show how to set up email in Thunderbird and add an account.
Two-step sign-in elsewhere in your hosting
Your mailbox is not the only login worth protecting. Turn on two-step sign-in for your hosting control panel too; our help article covers two-factor authentication in Plesk.
App passwords with Noiz
Private Email, our managed mail service, includes two-factor authentication for your users. If your mail has outgrown a shared server and you want two-step sign-in for every user, ask us for a Private Email quote, or get in touch to talk through the options.
Sources
Checked 19 October 2026.
Providers
- Google, Sign in with app passwords
- Apple, Sign in to apps with app-specific passwords
- Microsoft, How to get and use app passwords (personal accounts)
- Microsoft, Manage app passwords for two-step verification (work or school)
- Microsoft Learn, Respond to a compromised email account
Open-source software
Guidance
Noiz
- Private Email
- Email hosting
- Help articles linked in the text, on docs.noiz.ie
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
