---
title: Application passwords
canonical: https://wpsecurityninja.com/dictionary/application-passwords/
---
# Application passwords

Application passwords are per-app credentials WordPress can issue so integrations authenticate without using your main password.

Last updated: 2026-08-26

Also called: app passwords, WordPress application password

## Related terms

- [Two-factor authentication (2FA)](https://wpsecurityninja.com/dictionary/two-factor-authentication/): Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
- [Least privilege](https://wpsecurityninja.com/dictionary/least-privilege/): Least privilege means each user and integration gets only the access required for their job, nothing more.
- [REST API](https://wpsecurityninja.com/dictionary/rest-api/): The WordPress REST API is an HTTP JSON interface at /wp-json/ used by the editor, apps, and many plugins.
- [Zero trust](https://wpsecurityninja.com/dictionary/zero-trust/): Zero trust treats every request as untrusted until verified, and limits what any one identity can reach.

[Full guide](https://wpsecurityninja.com/wordpress-login-security-complete-guide/)

## Why it matters for WordPress

Mobile apps, CLI tools, and automations often need API access. Application passwords give them a revocable secret instead of storing the real admin password in a third-party service. They still carry the user’s capabilities. An app password on an Administrator is still administrator-level power if it leaks.

## How it shows up in practice

- “Application Passwords” section on a user profile in wp-admin
- REST or XML-RPC style basic auth using `username` + app password
- Leftover app passwords for tools nobody uses anymore
- Sites that disable the feature entirely when they have no integrations

## What to do

1. Create app passwords only for users who need the integration, preferably not shared god-accounts.
2. Revoke passwords when a tool is retired or a freelancer leaves.
3. Prefer the least privileged role that still works for the integration.
4. If you do not use any app integrations, disabling application passwords is a fair hardening choice.
5. 2FA on the human login still matters; app passwords are a separate secret to protect.