What it is
An
app password is a provider-generated credential that lets certain older apps or devices connect to an account without using the normal interactive sign-in. Google describes its app password as a 16-digit code available only when 2-Step Verification is on. It is not your main password and should not be reused or shared.
A practical example
An old mail client cannot offer modern
Sign in with Google, so its owner creates an app password. If that device is lost, the owner should revoke the app password in Google Account settings, not just remove the mail app's icon. Google states that a main password change revokes existing app passwords, but checking the list still reveals what was configured. Google
recommends modern sign-in instead and notes that app passwords are unavailable in some account configurations.
The useful rule
Use an app password only when a trusted device truly needs it and a modern sign-in option does not exist. Label and later revoke it when the device is retired. A request to create one for an unknown helper is a warning sign; it can give the helper persistent access to the account's data.
