A longer application password of at least 6 characters is recommended.
On starting up FTP-Go a check of the application password is made but this does not mean that the application password is stored on disk. Instead the password's "signature" is checked and it is possible (but very unlikely) that two passwords might have the same signature and FTP-Go will start anyway. In the unlikely event of this happening the stored site information will still be unintelligable and site access will not be possible.