Reference
App passwords in Google Workspace
A Google Workspace app password is a 16 character credential that lets an older application sign in to an account that has two step verification enabled. App passwords bypass the second factor entirely, which is why they are the weakest credential in most tenants.
| Format | 16 characters, shown once at creation |
|---|---|
| Requires | Two step verification enabled on the account |
| Second factor | Bypassed; the app password alone grants access |
| Scope | Full mailbox or service access, not limited per action |
| Revocation | Removed individually from the user's security settings |
Why they are a security problem
An app password is a long-lived credential with no second factor and, in most cases, no expiry. If it leaks, the attacker has mailbox access that survives a password change to the main account until the app password itself is revoked.
They also hide from most access reviews, because they sit in individual user security settings rather than in a tenant-level list that an administrator naturally reads.
Removing them without breaking anything
Start by finding what still uses them: usually a scanner, an accounting package, or a legacy IMAP client. Modern equivalents almost always support OAuth, which removes the need entirely.
Where a device genuinely cannot do OAuth, route it through a restricted service account and monitor it, rather than leaving an app password on a real user with mailbox access.
What we see that others don't say
In tenants that believe two step verification is fully enforced, surviving app passwords are the most common way accounts remain reachable with a single stolen credential.
What this doesn't cover
- App passwords are only available on accounts with two step verification enabled.
- Disabling them can break multifunction printers and older line-of-business software, so inventory first.
Questions we get asked
- Do app passwords bypass two step verification?
- Yes. An app password authenticates on its own without a second factor, which is exactly why an unaudited app password undermines a two step verification rollout that otherwise looks complete.
- Can an administrator see who has app passwords?
- Administrators can see and revoke app passwords per user in the Admin console user security settings, but there is no single tenant-wide list, which is why they survive most access reviews.
How this page is verified
Reviewed by Pearl Lemon Cloud security desk, Workspace security and compliance reviewers. Last checked .
- Behaviour verified against Google's app password documentation at the review date.
- Prevalence drawn from two step verification enforcement projects we have run.
Sources you can check
Related pages
Rolling out two step verification properly?
We inventory every legacy credential and app password in the tenant, move what can move to OAuth, and enforce the second factor without breaking the printer.