PostEaseThe short answer
A WordPress application password is a separate password you create for one tool, such as a scheduler, a mobile app or a script, so it can work with your site without knowing your real login password. Each one is tied to your user account, works only through WordPress’s APIs, and can be revoked on its own.
WordPress’s developer documentation describes them as “revocable, per-application credentials for programmatic access,” designed “to avoid sharing your main account password with third-party tools.” They have been part of WordPress since version 5.6, in December 2020.
Application password or login password
The two do different jobs. From WordPress’s documentation:
| What differs | Application password | Login password |
|---|---|---|
| Who types it | A tool, once, when you connect it | You, each time you sign in |
| Where it works | The REST API and, where enabled, XML-RPC | The wp-admin login form |
| Can it sign in to wp-admin? | No: it cannot be used on wp-login.php | Yes |
| How many | One per tool, each with its own name | One per account |
| After creation | Shown once, then stored hashed | Chosen by you |
Creating one
In wp-admin, go to Users, then Profile (or Users, All Users, Edit for another person), and find the Application Passwords section. Enter a name that says which tool it is for, generate it, and copy it straight away: WordPress shows it only once.
It appears in groups of four characters, such as abcd EFGH 1234 ijkl MNOP 6789. WordPress’s 2020 integration guide explains that it is 24 characters of letters and numbers, and that the spaces are optional: they are stripped before the password is checked.
How a tool uses it
The tool sends your username and the application password with each request, as HTTP Basic Authentication. Because Basic Auth can be read if sent unencrypted, WordPress makes application passwords available by default only on sites served over HTTPS, and its documentation says to always use HTTPS with them.
WordPress also records how each password is used. The profile section lists them by name with when each was last used and from which IP address; its 2020 guide notes that the last-used time is accurate to within 24 hours.
Keeping them safe
WordPress’s documentation recommends treating application passwords like any other secret:
| Practice | Why |
|---|---|
| One per tool, never reused | Revoking one tool leaves the others working |
| Revoke any you no longer use | The last-used column shows which have gone quiet |
| Rotate on a schedule or after a suspected leak | A new password cuts off whoever holds the old one |
| Keep your login password strong, with two-step sign-in | Application passwords do not protect interactive logins |
When the section is missing
If there is no Application Passwords section on your profile, or a tool gets a 401 or 403 error, WordPress’s troubleshooting list starts with HTTPS: the site must be served, and recognised, over HTTPS. After that, check that you used the application password rather than your login password, that no security plugin or custom code has switched the feature off, and that nothing between the tool and the site strips the Authorization header.
Application passwords and PostEase
PostEase connects to a WordPress site with an application password. In Channels, choose WordPress and enter the site address (starting with https://), your username and an application password named for PostEase. PostEase checks them against your site before saving them, stores them encrypted, and publishes your scheduled posts through the REST API. To disconnect from the site’s side, revoke that password in your profile. YouTube, X, LinkedIn (personal profile), Pinterest, Bluesky, and WordPress publishing are live today; Instagram, TikTok, Facebook, and Threads are pending each platform's own API approval.
Questions
Can I log in to WordPress with an application password?
No. WordPress says application passwords cannot be used on wp-login.php; they are for apps and scripts, not interactive sign-ins.
Why can’t I see Application Passwords in my profile?
The site may not be served over HTTPS, or a security plugin or custom code may have disabled the feature. WordPress makes it available by default only over HTTPS.
Do I include the spaces in an application password?
Either way works. WordPress strips the spaces before checking the password.
What happens if I revoke an application password?
The tool using it can no longer reach your site. Your login password and any other application passwords keep working.
Sources
- WordPress, Application Passwords, October 2026.
- WordPress, Authentication (REST API Handbook), October 2026.
- WordPress, Application Passwords (REST API reference), checked October 2026.
- WordPress, Application Passwords: Integration Guide, November 2020.