Some older mail apps or devices will not let you sign in, even after entering the correct password, because they cannot handle a provider’s two-step verification. That is usually the moment someone searches for how to turn on and use app passwords.
The short answer is that an app password is a one-time-generated code from your account provider, such as Google, Microsoft, or Apple, that stands in for your regular password inside one specific app or device that cannot complete modern sign-in.
This article walks through what an app password actually does, how to create one for Gmail, Outlook, or an Apple Account, and how to keep the whole process safe and organized.
Contents
- What an App Password Actually Is
- When You Actually Need One
- Setting One Up for a Google Account
- Setting One Up for Microsoft Accounts
- Setting One Up for an Apple Account
- Useful Ways to Manage Multiple App Passwords
- If the App Password Does Not Work
- Things to Watch Out For
🔍 What an App Password Actually Is
An app password is not a universal phone or computer setting. It is generated by a specific provider, like Google, Microsoft, or Apple, for a specific older app or device that cannot complete that provider’s normal sign-in process.
This matters because people sometimes look for one master switch that creates app passwords for every account at once. That switch does not exist, since each provider manages its own app passwords through its own account security settings.
It also helps to separate an app password from two other things it often gets confused with. An app password is not the same as two-factor authentication, and it is not the same as a password manager.
Two-factor authentication, sometimes called 2-Step Verification, is the security layer that confirms it is really you signing in, usually through a code sent to your phone or an authentication app. An app password is instead a workaround for apps that cannot process that extra step at all, so the provider gives the app its own special code to use in place of your main password.
A password manager is a separate tool that stores and fills in your various account passwords. It does not generate app passwords on its own; it can only store the app password once a provider has generated it for you.
💡 Key point: An app password replaces your regular password inside one specific app, while two-factor authentication confirms your identity during sign-in. They solve different problems.
⚙️ When You Actually Need One
Not every app or sign-in problem calls for an app password. Providers generally recommend using an app password only when the service offers that option and the app genuinely cannot complete the usual sign-in or two-step verification.
A common example is an older desktop mail program or an inherited device that only has a plain username and password field, with no way to accept a verification code or approve a prompt on your phone.
Before creating an app password, check whether the app offers a modern sign-in button instead, such as Sign in with Google. Google notes that app passwords are generally unnecessary when an app already supports that kind of sign-in, since the modern option is typically simpler and keeps your account protections intact.
There is also one notable exception. Google accounts enrolled in its Advanced Protection Program cannot use app passwords at all, as part of that program’s stricter security model. If your account is enrolled in that program, look for the provider’s alternative sign-in guidance for the specific app you are trying to use.
| Provider | Where App Passwords Live | Requirement Before Creating One |
|---|---|---|
| Google Account | Security & sign-in settings | 2-Step Verification turned on |
| Microsoft personal account | Advanced security options | Two-step verification turned on |
| Microsoft work or school account | Security info, if enabled by admin | Organization must allow the feature |
| Apple Account | Sign-In and Security settings | Two-factor authentication required |
📱 Setting One Up for a Google Account
Google’s app password feature lives inside your account’s security settings rather than inside Gmail or any single app. The first requirement is that 2-Step Verification must already be turned on for the account.
Once that is active, you can generate a code specifically for the app or device that needs it. Google produces a 16-digit passcode that you type into that app’s password field instead of your normal Google password.
- Turn on 2-Step Verification for the Google Account, if it is not already on.
- Open the account’s Security & sign-in settings and select App passwords. You may be asked to sign in again to confirm it is you.
- Create a password for the specific app or device that needs it.
- Google generates a 16-digit passcode; copy it exactly as shown.
- Enter that passcode in the app’s password field, in place of your regular Google password.
Menu wording inside Google’s account settings can shift slightly between updates, so if App passwords is not where expected, try typing it into the settings search bar instead of hunting through every menu. Since this setting touches account security directly, it is a good idea to check Google’s official help page for the exact current wording if something on the screen looks different from these steps.
🛡️ Setting One Up for Microsoft Accounts
Microsoft splits this feature into two paths: one for personal Microsoft accounts and one for work or school accounts managed by an organization. The steps look similar, but where you find the setting is different.
For a personal Microsoft account, two-step verification needs to be turned on before an app password can be created. The setting itself lives under Advanced security options.
- Turn on two-step verification for the personal Microsoft account.
- Open the account’s Advanced security options and find App passwords.
- Select Create password.
- Enter the generated password in the app or device, in place of the usual Microsoft password.
Work or school accounts are different because an organization’s IT administrator controls whether this feature is available at all. If it is enabled, the process runs through a different portal.
- Go to myaccount.microsoft.com and select Security info.
- Select Add method, then choose App password, then select Add.
- Name the app so it is easy to recognize later, then select Next.
- Enter the generated password in the app that needs it.
If App password does not appear as an option on a work or school account, that typically means the organization has not turned it on. In that situation, contacting the organization’s IT administrator is the recommended next step, since an individual user may not be able to enable it alone.
💡 Key point: Personal and work Microsoft accounts manage app passwords in two completely different places, and a work account depends on your organization’s settings.
🔐 Setting One Up for an Apple Account
Apple calls this feature an app-specific password, and it is managed from the Apple Account website rather than from a Settings app menu on a phone or computer. Two-factor authentication is required before this option appears.
- Sign in at account.apple.com.
- Under Sign-In and Security, select App-Specific Passwords.
- Select Generate an app-specific password and follow the prompts on screen.
- Enter the generated password in the third-party app’s password field when it asks for the Apple Account.
This process is used for third-party apps that need to sign in with an Apple Account but cannot handle Apple’s regular two-factor sign-in flow, such as certain older mail clients or calendar apps.
Because this involves account security and sign-in credentials, it is a good idea to check Apple’s official support page for the current screen layout before generating a password, since wording inside account.apple.com can shift with updates.
As with Google and Microsoft, Apple’s app-specific password is meant for one app at a time. If several older apps need access, each one gets its own separately generated password rather than reusing a single code everywhere.
🗂️ Useful Ways to Manage Multiple App Passwords
Once more than one app or device needs its own password, keeping track of them becomes the real challenge. Each provider’s app password screen typically shows a list of the ones currently active, along with the name given to each at creation.
Naming each password clearly at the moment of creation, such as identifying it by the specific app or device it belongs to, saves confusion later when deciding which ones are still needed.
A password manager can be useful here, but only as a place to store the generated code once it exists. It does not create app passwords on its own, and it cannot bypass a provider’s requirement to turn on two-step verification or two-factor authentication first.
Periodically reviewing the list of active app passwords for an account is a reasonable habit, especially after replacing an old phone, retiring a mail client, or no longer using a particular device. An unused app password sitting in that list offers no benefit and is best removed.
⚠️ Watch out: Never enter an app password anywhere except the specific app’s own password field it was created for. It is a special credential, not a replacement for your everyday account password.
🧩 If the App Password Does Not Work
A newly created app password that still gets rejected is a common and usually fixable problem. The first thing to check is whether the code was entered into the correct account’s password field, since a single device may be signed into more than one email or cloud account.
Next, confirm that the provider’s required security step is actually turned on. Google requires 2-Step Verification, Microsoft requires two-step verification, and Apple requires two-factor authentication before an app password can even be generated or used successfully.
It is also worth confirming that the app genuinely supports app passwords in the first place. Some newer versions of mail apps or other software have dropped support for this older method entirely in favor of modern sign-in, so an outdated app password field may no longer function as expected.
If none of that resolves the issue, two practical options remain: update the app to its latest version, since many apps eventually add support for modern sign-in, or switch to the provider’s built-in sign-in option, such as Sign in with Google, if the app offers it as an alternative.
| Symptom | Likely Cause | What to Try |
|---|---|---|
| Password rejected immediately | Wrong account or wrong field | Re-check which account the app is trying to sign into |
| Cannot find App passwords option | Two-step verification not yet enabled | Turn on 2-Step Verification or two-factor authentication first |
| Option missing on work account | Organization has not enabled it | Contact the organization’s IT administrator |
| Worked before, fails now | Password revoked after account password change | Generate a new app password for that app |
⚠️ Things to Watch Out For
An app password is a powerful credential because it grants access to the app it was created for, so it deserves the same caution as a regular password. It should never be shared with anyone else or reused in a different app.
Create an app password only for a trusted app or device, and only when that app genuinely lacks a more secure sign-in method. Entering it anywhere outside that one app’s password field defeats its purpose.
Changing your main account password has consequences for existing app passwords. Google states that changing your account password revokes its app passwords, and Apple states that changing or resetting the primary password revokes its app-specific passwords. That means every app using an old app password will need a freshly generated one afterward.
For Microsoft work or school accounts, unused app passwords can usually be deleted directly from Security info if that option is available to the account. Revoking passwords for apps or devices no longer in use is a simple way to reduce unnecessary access to an account over time.
🙋 Frequently Asked Questions
Q. Can one app password be used for multiple apps?
No. Each app password from Google, Microsoft, or Apple is intended for one specific app or device, and providers generate a separate code for each one that needs it.
Q. Does turning on an app password replace two-factor authentication?
No. App passwords exist precisely because the app cannot process two-factor authentication or two-step verification, so the provider issues a separate credential instead of bypassing that security layer for the rest of the account.
Q. What happens to an app password if the phone is lost or replaced?
The app password itself still exists on the provider’s account until it is manually revoked, so reviewing and removing passwords tied to a lost or replaced device is recommended.
Q. Why does Google show a 16-digit code while Apple and Microsoft look different?
Each provider generates its own password format. Google specifically produces a 16-digit passcode, while Apple and Microsoft generate codes in their own formats, and each should be entered exactly as shown.
Q. Can a Google account with Advanced Protection Program enabled use app passwords?
No. Google states that accounts enrolled in its Advanced Protection Program cannot use app passwords, as part of that program’s stricter account protections.
Q. Is an app password the same thing as a recovery code?
No. A recovery code is typically used to regain account access if a sign-in method is lost, while an app password is created specifically to let one particular app sign in on an ongoing basis.
Q. Why does a work or school account not show the App password option at all?
That setting depends on the organization’s IT administrator enabling it. If it is not turned on at the organization level, an individual account holder generally cannot enable it alone.
📌 Quick Summary
| Item | Details |
|---|---|
| What it is | A provider-generated password for one specific app or device |
| Not the same as | Two-factor authentication or a password manager |
| Google requirement | 2-Step Verification must be turned on first |
| Microsoft requirement | Two-step verification; work accounts depend on IT admin settings |
| Apple requirement | Two-factor authentication required |
| Changing main password | Revokes existing app passwords on Google and Apple accounts |
| Best practice | Create one only for a trusted app lacking modern sign-in, and review unused ones periodically |
A reasonable first step is checking whether the app giving trouble actually offers a modern sign-in option like Sign in with Google before generating any app password at all.
This article is based on public information available at the time of writing. Menus and steps may change with app or device updates.