The short answer
If you are retiring a mail app that used a Google app password, the cleanup is a credential review, not just an uninstall. Google app passwords are 16-digit credentials used in specific two-step-verification situations, and they can be removed individually from the account’s App passwords settings. Removing the app from your phone does not necessarily remove the credential from your Google Account. The practical order is: identify what the mail app actually used, remove the credential you no longer need, keep a recovery method you control, and only then delete local data.
This guide is for the person who set up a mail client months or years ago and now wants to close that loop. It is not a general account lookup tutorial. The same review mindset applies to other connected accounts, and the companion guide on finding accounts signed in with Google covers that wider inventory.
Step 1: Identify what the mail app actually used
Before removing anything, establish which connection type the mail app relied on. There are three common cases, and they are not interchangeable.
| What you see | What it likely is | What to review |
|---|---|---|
| A 16-digit credential generated for a specific app | An app password | The App passwords settings for that Google Account |
| The app appears under third-party connections with Google sign-in | A Sign in with Google connection | The account’s connected-apps or third-party access settings |
| The app simply has a session on your phone or computer | A normal device session | The device’s own account/session list and the app’s local data |
A useful rule: an app password is a credential you generated and can remove by name. A Sign in with Google connection is a permission grant you review and revoke. A device session is a login state on a specific device. Treating one as another leads to false confidence.
If you cannot tell which one applies, do not generate a new app password to “test” it. Unnecessary new credentials widen the surface you have to manage. Instead, check the mail app’s own account settings for the authentication method it lists, then compare that with your Google Account’s security settings.
Step 2: Remove the app password you no longer need
Once you have confirmed the mail app used an app password, remove that specific credential rather than leaving it dormant.
- Sign in to the Google Account that the mail app was configured for.
- Open the security settings and locate App passwords. This section is only relevant when two-step verification is active; if you do not see it, the account may not use app passwords at all.
- Identify the entry by the name you gave it when it was created. Names are often generic, so match by the app you are retiring and the approximate creation date if shown.
- Remove that entry. Other app passwords for other apps should be left alone unless you are also retiring those apps.
- Confirm the mail app can no longer sync. If it still receives mail, you removed the wrong entry or the app is using a different connection type.
Google app passwords are 16-digit credentials used in specific two-step-verification situations. Source
Old app passwords can be removed from the account’s App passwords settings. Source
If you are unsure whether an entry belongs to the app you are retiring, pause. Removing the wrong app password can break a different client you still rely on, such as a calendar sync tool or a backup script.
Step 3: Decide between targeted removal and a password change
Sometimes the cleanest move is not to hunt through a list of app passwords but to invalidate them all at once by changing the account password.
Changing the Google Account password revokes its app passwords. Source
Use this decision table to choose.
| Situation | Targeted removal of one app password | Changing the Google Account password |
|---|---|---|
| You know exactly which app you are retiring | Best fit: precise, minimal disruption | Works, but signs out everything and forces re-authentication |
| You are unsure which app password belongs to which app | Possible, but risky | Cleaner reset point |
| You still rely on other app passwords | Preserves them | Revokes them; you must recreate the ones you still need |
| You suspect the credential was exposed | Not sufficient on its own | Stronger, because it revokes all app passwords |
| You only want to stop one old client | Best fit | Overkill |
Changing the password is the blunt instrument. It revokes app passwords, so any other app that depends on one will stop working until you set it up again. That is acceptable when you are doing a full cleanup, but it is a poor choice if you are only retiring one mail client and still depend on others.
Step 4: Distinguish app passwords from Sign in with Google connections
A frequent mistake is to revoke a Sign in with Google connection and assume the app password is gone, or the reverse. They live in different places and have different effects.
- App password removed: the specific app using that 16-digit credential loses access. Other apps and browser sessions are unaffected.
- Sign in with Google connection revoked: the app can no longer use Google as its sign-in method. This is a permission change, not account deletion.
- Device session signed out: the login state on that device ends, but a stored app password or connection grant may still exist elsewhere.
None of these actions deletes the account, and none of them establishes that data the app already stored has been erased. An edited or empty profile in the app is not proof of deletion either. If data retention matters to you, check the app’s own account controls separately.
For a broader review of which services are connected to your Google Account, see the guide on finding accounts signed in with Google. That guide helps you inventory connections; this one helps you retire a specific mail credential.
Step 5: Preserve recovery access until the job is done
Before you remove anything, confirm you can still sign in to the Google Account through a method you control. That usually means a password you know plus a recovery option that is current and reachable. Do not delete a recovery method, close an email address, or remove a phone number until the credential cleanup is complete and you have verified access.
A safe sequence looks like this:
- Confirm you can sign in and complete two-step verification.
- Note which app passwords exist and which app each belongs to.
- Remove only the credential for the retired mail app, or change the password if you are doing a full reset.
- Verify the retired app no longer syncs.
- Verify your other apps still work.
- Only then remove local data from the old device or app.
If step 1 fails, stop. Cleanup that locks you out is worse than a dormant credential.
Common mistakes
- Uninstalling the app and calling it done. The app password or connection grant can remain on the account side.
- Generating a fresh app password to “check” the old one. This adds a credential instead of reducing them.
- Removing a Sign in with Google connection and assuming app passwords are gone. They are separate mechanisms.
- Changing the password without planning for other apps. Changing the Google Account password revokes its app passwords, so other clients will need re-authentication.
- Deleting a recovery method before cleanup is finished. Keep a recovery path you control until you have confirmed access and completed removal.
- Treating an empty profile as deletion. Removing a login connection or editing a profile does not establish that stored data is gone.
- Sharing screenshots of app password lists. Even partial credentials and account identifiers are sensitive; describe the setup in words instead.
Protecting your own footprint
Retiring a mail app is a small act of hygiene, but it fits a larger pattern: old credentials and old connections accumulate quietly. A periodic review — say, when you change phones or retire a client — keeps the list short and the decisions easy.
Start with the account side, not the device side. List the app passwords and connected apps, match each to a current use, and remove what no longer has one. Keep recovery methods current and under your control. Then clean up local data.
If part of your review involves checking which public handles and profiles are associated with an identity you manage, a username lookup can help you see what is publicly visible. TraceSeek checks 3,000+ platforms and offers a free first scan, with the product stating a scan time of 20-30 seconds. Public username matches are leads, not proof of ownership, and a username search is not a complete account inventory. TraceSeek does not change platform settings, revoke app passwords, or expose private records; it is a way to review public handles, not a substitute for the account-side steps above.
Key facts
Google app passwords are 16-digit credentials used in specific two-step-verification situations.
Old app passwords can be removed from the account’s App passwords settings.
Changing the Google Account password revokes its app passwords.
Removing a Sign in with Google connection is a permission change, not account deletion.
Public username matches are leads, not proof of ownership, and a username search is not a complete account inventory.