# Nextcloud-App-Passwords

> [!toc] Table of Contents
>
> <!-- toc -->

Nextcloud allows you to create app passwords. This allows you to assign a different
password to each device or app that you connect to your account. The advantage of this
is that you can easily revoke access to your account for individual devices or apps from
your account settings.

- Log in to the cloud and click on the avatar in the top right corner

![Nextcloud avatar](https://esc-it.org/assets/articles/en/instructions/nextcloud/wi-avatar.png)

- Select `Settings` > `Security`

![Nextcloud security settings](https://esc-it.org/assets/articles/en/instructions/nextcloud/wi-app_password.png)

Here you can create a new app password:

1. First, give the new password a name so that you know what it is used for later. Give
   each app password a unique name so you don't accidentally revoke access to the wrong
   application. Here, we will call it “Sync Client.”
2. Click `Create new app password`

![name new app password](https://esc-it.org/assets/articles/en/instructions/nextcloud/wi-app_password_1.png)

The password is now displayed for the first and last time! So make sure you copied the
password to the application you want to connect with Nextcloud you before close the
password window. In case you closed the password window too early, simply delete the
lost password and create a new one instead.

The button `Show GR code for mobile apps` allows Nextcloud apps for mobile devices to
log in once. In case you want to connect Nextcloud to a mobile application, this is more
convenient then typing the password manually.

![one-time view app password](https://esc-it.org/assets/articles/en/instructions/nextcloud/wi-app_password_2.png)

Here we can see the different “sessions” that can access our account.

![different sessions](https://esc-it.org/assets/articles/en/instructions/nextcloud/wi-app_password_3.png)

## Delete old sessions

Here you will notice that every time we log in to the browser and do not log out later
using the `Logout button`, this “session” remains valid. This is a bit annoying, as we
quickly lose track of whether these are our own “sessions” or whether, for example, an
attacker has logged in in the meantime.

![delete old sessions](https://esc-it.org/assets/articles/en/instructions/nextcloud/wi-app_password_4_oldsessions.png)

Here, for example, you can see that we did not log out properly 10 hours ago, but simply
closed the browser window. The session is theoretically still valid, but no longer
useful to us. So we delete the old session.