App passwords are separate passwords that only one specific app or device is allowed to use — not your account password. They’re the right solution for the desktop client, mobile apps, WebDAV mounts, CalDAV sync and anything else that accesses Nextcloud automatically.
Why app passwords
Three reasons:
1. 2FA compatibility
If you have 2FA enabled, a sync client can’t ask for a 2FA code every time — that would be annoying. App passwords bypass 2FA for that specific app while keeping 2FA protection for interactive browser logins.
2. Targeted revocation
If you lose your smartphone, you want to end only that smartphone’s session — not force every other device to log out. Ending an app password = disconnecting just that one device.
3. Audit visibility
In Personal settings → Security you see all active app passwords with their labels. You can trace what runs where.
Creating app passwords
Option A: automatically on app login
When you connect the desktop client or mobile app, the login flow runs through the browser:
- The app asks for the server URL
- The browser opens, you log in normally (with 2FA if active)
- The browser asks: “Grant the app access?” → confirm
- The app receives an app password and stores it locally
Nothing manual to do on your side.
Option B: manually (for WebDAV, CalDAV, third-party tools)
- Browser → Personal settings → Security → Devices & sessions
- Type an app name (pick something descriptive: “Mac CalDAV”, “Linux backup script”, “Outlook on the office PC”)
- Create new app password
- Copy the password — it’s shown only once
Then log in to the respective app with the app password and your username.
Revoking an app password
When a device is lost / stolen / no longer used:
Personal settings → Security → Devices & sessions → trash icon next to the session → confirm.
From that moment, this app / device can no longer fetch or change any data.
The rest of your sessions stay untouched.
When naming matters
We often see setups where every app password is called “Nextcloud Client” because that’s the default name. With 5 devices you won’t know which one to revoke.
Recommendation: on every login setup, give the device a name that’s unambiguous:
- “MacBook Pro personal”
- “iPhone 13 Mike”
- “Backup script server VPS”
- “Outlook office PC”
On the mobile/desktop client you can change the name in the client settings.
Sessions vs app passwords — the difference
Devices & sessions lists two kinds:
- Active browser sessions — where you’re currently logged in via browser
- App passwords — sync clients, mobile apps, WebDAV tools
You can end both, but they don’t do quite the same thing:
- Ending a browser session = that browser tab gets logged out
- Ending an app password = the token becomes invalid, the app has to re-authenticate
The GUI shows both in one list. When ending one, make sure you’re hitting the right thing.
Browser login — does that use an app password?
No. The browser uses your regular account password plus 2FA (if active). App passwords are only for non-interactive apps.
If you enter an app password in the browser, it won’t be accepted.
What to do if someone has my account password
Change the account password:
- Personal settings → Security → Change password
- On an account password change, all app passwords are revoked automatically — every sync client and mobile app has to log in again
That’s intentional: with a compromised account password, nobody should be able to keep using existing sessions.
If only one app password is compromised (say, a file containing a backup script’s login leaked): just revoke that one app password, create a new one, put it in the script. The account password stays unchanged.
Frequently asked questions
How long are app passwords valid? Indefinitely — until you revoke them manually or change your account password. On request we can configure automatic expiry (e.g. 6 months), but the default is forever.
What if I’ve lost the app password? You can’t recover it — Nextcloud shows it only once at creation. Solution: generate a new app password, enter it in the app, revoke the old one.
Can someone take over my account with an app password? No. App passwords can’t enter the admin backend, can’t change the account password, can’t disable 2FA. Only normal file and sharing operations plus the specific app function.
Is 2FA necessary if I use app passwords? Recommended, yes. 2FA protects the browser login and the creation of app passwords — without 2FA, an attacker with your account password could generate additional app passwords.
Are app passwords visible in the browser after creation? No. We never see the password itself anywhere either — only the name, the creation date, the last-used date.
App password can’t be created — permission denied? This can happen with read-only accounts or certain federation setups. Open a ticket and we’ll check the account config.
Push notifications and app passwords — how are they related? A mobile app password automatically includes push token permissions. When you revoke the session, push goes silent too.
What does the server admin (you) see about app passwords? The server admin sees: the app password’s name, creation date, last use, IP address of last use. Not: the password itself.
What’s next
First login as a Nextcloud admin
What to do after your Nextcloud is provisioned — login, profile, the important first settings, what we handle and what you handle.
Admin GUI overview — what you'll find where
Nextcloud's administration settings are big. Here's a tour of the sections that matter and what they do.
Creating users and groups
Create users for family, club or team, organize groups, set quotas, control login behavior.
Sharing — files with others, internally and externally
Sharing files in Nextcloud — within your cloud with other users, with groups, or externally via sharing link.