Bluesky app passwords: what they are, and whether it is safe to give one out

A tool is asking for an app password and you want to know what you are handing over. Exactly what one can and cannot do, and how to judge whether to give it.

You have found a Bluesky tool you want to try, and it is asking for an app password. Reasonably, you have stopped to wonder what that actually gives it.

Short answer: an app password is a separate, revocable credential that does most of what your real password does, minus the things you would never want a third party doing. It is a deliberately safer way to connect a tool than handing over your account password, which is what the alternative would be.

The longer answer is worth five minutes, because safer is not the same as safe, and the difference is entirely about which tool you give it to.

What an app password is

It is a credential you generate inside Bluesky, for one purpose, that you can destroy without consequence. You can have several — one per tool — and revoking one has no effect on the others or on your ability to log in normally.

Bluesky shows it once, as four groups of four characters. You paste it into the tool and never see it again, which is the point: it is not a password you remember, it is a key you issue.

What it cannot do — the important part

This is the bit that actually answers the safety question. Compared to your real password, an app password is blocked from the destructive actions:

• It cannot delete your account.
• It cannot migrate your account to a different server.
• It cannot create more app passwords, so a compromised one cannot quietly mint others.

So the worst realistic case is a tool that posts things you did not write, or reads things you would rather it did not. That is genuinely bad and it is also recoverable in one click, which is not true of a leaked account password.

The direct messages checkbox

When you create one, Bluesky offers a checkbox to allow access to your direct messages. It is off by default and should usually stay off.

A scheduling tool has no reason to read your DMs. Neither does an analytics tool, a feed builder, or a backup tool. If something asks you to switch it on, it should be obvious from what the tool does why it needs it — an inbox client, say. If it is not obvious, that is a reason to stop and ask, not a box to tick to make the error go away.

How to create one

In Bluesky, open Settings → Privacy and Security → App Passwords and add one. If the menu has moved, search the settings for app password.

Name it after the tool you are about to connect. This sounds fussy and pays off the first time you look at a list of five and try to work out which one belongs to the thing you stopped using in March.

How to revoke one

Same screen. Delete the entry and that credential stops working immediately. The tool loses access, everything else keeps working, and you do not have to change your real password or sign out anywhere.

Worth doing whenever you stop using a tool, and worth doing immediately if a tool you use is ever reported as breached. It costs nothing.

How to judge whether a tool deserves one

The credential is safe by design. The question is the tool. A few things worth checking, none of which are specific to any product:

• Does it ask for DM access it does not need? The clearest single signal.
• Does it explain what it will do with the connection, or does it just want the field filled in?
• Is there a real company or person behind it, with a way to contact them?
• Can you disconnect from inside the tool, or does it assume you will never leave?
• Does it ask for your account password instead? Anything that does should be closed immediately. There is no legitimate reason for it.

That last one is the only hard rule here. Everything else is judgement.

What is replacing app passwords

Bluesky has said OAuth is expected to become the primary way apps authenticate, replacing app passwords over time. That is the familiar flow you get on other networks: you are sent to Bluesky, you approve specific permissions, and the tool never sees a credential at all.

It is better, and it is coming. Until it lands broadly, app passwords are how this works — and understanding them properly is more useful than avoiding every tool until the migration is finished.

If you are here because you are setting up scheduling specifically, the practical walkthrough is in the companion guide to this one.