---
title: Application passwords
canonical: https://wpsecurityninja.com/dictionary/application-passwords/
---
# Application passwords

Application passwords are per-app credentials WordPress can issue so integrations authenticate without using your main password.

[Full guide](https://wpsecurityninja.com/wordpress-login-security-complete-guide/)

## Why it matters for WordPress

Mobile apps, CLI tools, and automations often need API access. Application passwords give them a revocable secret instead of storing the real admin password in a third-party service. They still carry the user’s capabilities. An app password on an Administrator is still administrator-level power if it leaks.

## How it shows up in practice

- “Application Passwords” section on a user profile in wp-admin
- REST or XML-RPC style basic auth using `username` + app password
- Leftover app passwords for tools nobody uses anymore
- Sites that disable the feature entirely when they have no integrations

## What to do

1. Create app passwords only for users who need the integration, preferably not shared god-accounts.
2. Revoke passwords when a tool is retired or a freelancer leaves.
3. Prefer the least privileged role that still works for the integration.
4. If you do not use any app integrations, disabling application passwords is a fair hardening choice.
5. 2FA on the human login still matters; app passwords are a separate secret to protect.