Theme
App passwords
An app password is a separate credential for the programs that cannot show a browser sign in: WinSCP, FileZilla, Cyberduck, the sftp command, a backup script.
If you sign in to the web client through your organization's sign in page, you have no ordinary password here at all, and an app password is how you connect with a desktop client. If you do have a password, app passwords are still worth using: each program gets its own credential, and you can revoke one without touching anything else.
What one is
- A generated credential, shown to you exactly once, at creation. It cannot be shown again, only revoked. Store it in your password manager the moment you see it.
- Valid for the file transfer protocols only: SFTP, FTPS, FTPES. An app password can never open the web client.
- Scoped: you choose which of those protocols it may open, and you can give it an expiry.
- Yours to revoke, and your administrator's: either of you can end one at any moment.
You may hold up to ten active app passwords. If you reach the limit, revoke one you no longer use.
Creating one
- Sign in to the web client and open Settings.
- Under App passwords, choose Create app password.
- Give it a name that says what it is for: "Laptop WinSCP", "Nightly backup".
- Pick which protocols it may open. Leaving everything unchecked allows all the listed ones.
- Optionally set an expiry in days. A credential for a contractor or a one off job should have one.
- Confirm it is you. If you sign in with a password, you are asked for it (or a code, or a passkey). If you sign in through your organization, a recent sign in is your proof: if your session is older than a few minutes, you are sent through your organization's sign in again and brought straight back.
- Copy the credential now. This is the only time it is shown.
Using it
In your desktop client or script, use it exactly like a password:
| Field | Value |
|---|---|
| Username | Your full username, for example alice@acme |
| Password | The app password |
That is all. WinSCP, FileZilla, Cyberduck and OpenSSH need nothing special; see Connect with an SFTP client and Connect with an FTPS client for the connection details.
Revoking one
On the same Settings card, choose Revoke next to the credential. New sign ins with it are refused immediately. Revoke anything you no longer use, and revoke first and ask questions later if you think one may have leaked.
Your administrator can see the list of your app passwords (names and protocols, never the credentials themselves) and can revoke any of them.
When it stops working
- It was revoked or it expired. Create a new one; the old one cannot be revived.
- The protocol is not in its scope. A credential created for SFTP only will not open FTPS. Check the protocols shown next to it on the Settings card.
- Your site requires strong sign in. On such a site, passwords of every kind are refused on the file transfer protocols, app passwords included, and an SSH key is the way in. The Settings page tells you if this applies to you.
- Anything else: ask whoever administers your site. Failures deliberately do not explain themselves to the person connecting.