App passwords

An app password is a special key, different from your own, that you give to an old app or device that doesn't know how to ask for two-step verification.

Updated on October 26, 2026 · Reading time: 3 min

What it is

Extra key for old apps

Since

2011 (Google)

Verdict

No

What it is

When you turn on two-step verification (2FA), some older apps or devices (an old mail client, a printer, a watch) don't know how to ask for the second step. For them, the provider generates an app password: a long, one-time code for that specific device, which replaces your normal password only there.

Google calls it an "app password" and generates it from your account's security settings, as long as you have two-step verification turned on.

When it was introduced

Google introduced app passwords alongside two-step verification for personal accounts, which it started rolling out in 2011, first for Google Apps (now Google Workspace) and later for all Gmail accounts.

Why it's used

It solves a technical problem: an old app doesn't understand the second step, and without this special key it would never be able to sign in. It lets you keep using that app without turning off two-step verification for the rest of the account.

The flip side: it's a secondary door into your account that, once created, rarely gets reviewed. If you forget it's active on a device you no longer use, or if it falls into the wrong hands, that app keeps getting in without ever asking for the second step.

Should you use it?

Check this

• Do you have app passwords active that you no longer remember the purpose of?
• Is any of them still active on a device you no longer use or have sold?

Official sources: Sign in with app passwords (Google)