An app password is a long-lived, application-specific password created for older software or devices that cannot use modern two-step verification. It acts like a substitute login secret, letting a legacy mail client, scanner, or mobile app connect to an account without handling a second factor.
In cyber security, app passwords matter because they weaken the protection offered by multifactor authentication. If an attacker convinces a user to generate one, steals it from a device, or reuses it from a compromised account, they may gain durable access until the password is revoked. Defenders should treat app passwords as legacy exceptions: restrict their use, monitor for their creation and use, and prefer phishing-resistant sign-in methods or modern OAuth-based access where possible.