[fps_doug]

This is surprisingly non-shitty by Google. I must admit that I didn't know that before. Can you limit such a passcode to just IMAP/SMTP, or can it be used to log in to other parts of Google?

[bandrami]

They provide full access to your entire google account, but you can create as many as you want and revoke them whenever you feel like it.

[rfoo]

This passcode is inherently limited to the service it bound to (IMAP or POP3), that's the whole point: don't expose your account password to something which only needs a finer-grained access.

Edit: that's incorrect, see replies.

[bandrami]

"This App Password provides full access to your Google account"

-- Google, when you make an App Password

[fps_doug]

You're directly contradicting your sibling comment. I guess I'll experiment with this in the coming days, although I'm a little worried tinkering too much will just completely lock me out of my account.