Gmail App Password: Create One, IMAP Settings, Fixes

A Gmail app password is a 16-character code that lets an app or device without Sign in with Google reach your Gmail over IMAP, POP, or SMTP. You create it at myaccount.google.com/apppasswords once 2-Step Verification is on. In the app, enter your full Gmail address as the username and the app password as the password, with imap.gmail.com on port 993 for incoming mail and smtp.gmail.com on port 465 or 587 for sending. If the app offers Sign in with Google, Google recommends that instead. An app password is also how CatchNone reads your own domain’s alias mail from Gmail, read-only and straight from your iPhone, iPad, or Mac.

Google’s error messages call it an application-specific password; many guides say app-specific password. Google’s help pages linked below were last checked on September 25, 2026.

Are Gmail app passwords still available in 2026?

Yes. As of September 2026, Google’s Sign in with app passwords page describes them as a current feature and gives no end date. The same page says they “aren’t recommended and are unnecessary in most cases.”

What ended is signing in with your normal Google password. Google’s Gmail help says Gmail “no longer supports third-party apps or devices which require you to share your Google username and password.” For Google Workspace accounts, that support ended on May 1, 2025, according to Google Workspace Updates. Google’s transition guide says CalDAV, CardDAV, IMAP, SMTP, and POP “will no longer work with legacy passwords,” and that you no longer use a password for access “with the exception of app passwords.”

So an app reaches Gmail in one of two ways: Sign in with Google (OAuth) or an app password.

Before you start: turn on 2-Step Verification

Google lets you create app passwords only on accounts with 2-Step Verification. To turn it on for a personal account (Google’s steps, as of September 2026):

1. Open your Google Account.
2. Select Security & sign-in.
3. Under How you sign in to Google, select Turn on 2-Step Verification.
4. Follow the on-screen steps.

Or go straight to myaccount.google.com/signinoptions/two-step-verification. On a work or school account these steps may not work, because your administrator controls 2-Step Verification.

How to create a Gmail app password

1. Go to myaccount.google.com/apppasswords and sign in again if asked. Google’s help also gives the path Google Account → Security & sign-in → How you sign in to Google → App passwords. If you don’t see that entry, use the direct link.
2. Type a name you’ll recognize later, such as “Office printer” or “Home NAS,” and select Create.
3. Copy the password Google shows. You see it only once. If you lose it, create a new one.
4. In the app, enter your full email address as the username and paste the app password into the password field.

Google’s help doesn’t document this screen, so the labels in steps 2 and 3 follow current third-party guides (September 2026) and may differ slightly on your account.

Make one app password per app or device. You usually enter it once, and separate passwords let you revoke one app without breaking the others.

Why “App passwords” is missing or not available

If myaccount.google.com/apppasswords says “The setting you are looking for is not available for your account,” or the entry never appears, check 2-Step Verification first. The other three rows are the possible reasons Google lists:

Google Workspace: why app passwords aren’t available

A work account isn’t excluded by default: Google’s admin help for third-party email clients tells admins to have users “create and use App passwords” for clients without OAuth. Whether it works depends on these Admin console settings (as of September 2026):

• 2-Step Verification allowed: Menu → Security → Authentication → 2-step verification → Allow users to turn on 2-Step Verification.
• Methods: if the 2-Step Verification method is set to Only security key (which now also covers passkeys), users are in the security-keys-only case above.
• Advanced Protection: users can enroll themselves unless the admin turns off enrollment (Menu → Security → Authentication → Advanced Protection Program; on by default). App passwords are blocked for enrolled users.
• IMAP access (this doesn’t hide App passwords, but it decides whether a mail client using one can connect): Menu → Apps → Google Workspace → Gmail → End User Access → POP and IMAP access. Check Enable IMAP access for all users and select Allow any mail client. Under Restrict which mail clients users can use (OAuth mail clients only), app-password clients can’t connect (IMAP admin help).

Gmail IMAP and SMTP settings

Gmail’s incoming mail server is imap.gmail.com on port 993 with SSL/TLS. The outgoing mail server is smtp.gmail.com on port 465 (SSL/TLS) or 587 (STARTTLS). On personal Gmail and Workspace alike, sign in with your full email address and an app password.

POP, if you need it, is pop.gmail.com on port 995 with SSL.

Google’s consumer help on adding Gmail to another email client no longer lists these values. They come from Google’s developer documentation and its Workspace admin help.

Either SMTP port works. RFC 8314 finds no significant security difference between them when both are implemented correctly and TLS is required. So on 587, choose a setting that requires STARTTLS, not one that uses it only “if available.”

On personal Gmail there’s nothing to switch on. Since January 2025, IMAP is always on and the old “Enable IMAP” option is gone. On Workspace, the admin setting above decides.

Gmail’s folders over IMAP

Gmail labels show up as folders: INBOX, [Gmail]/All Mail, [Gmail]/Sent Mail, [Gmail]/Spam, [Gmail]/Trash, and others. On some accounts the prefix is Google Mail rather than Gmail, as Google’s IMAP documentation notes. Two of Google’s recommended client settings matter most:

• Don’t turn on your app’s own junk filter. Gmail already sorts spam into [Gmail]/Spam.
• Don’t make the app move deleted messages to Trash, or Gmail deletes them for good after 30 days. With the default setting, a message you delete from a folder stays in All Mail.

For how deletions sync between an app and the server, see Does IMAP delete email from the server?

Gmail in Outlook, Apple Mail, and iPhone

Google’s Workspace help says current versions of Outlook, Apple Mail, and Samsung Mail support Sign in with Google, so they need no app password or manual settings.

In new Outlook for Windows, go to View → View settings → Accounts → Your accounts → Add Account, enter your Gmail address, select Continue, and select Allow on Google’s permissions screen. In classic Outlook, select File → Add Account, enter your address, select Connect, sign in, and select Allow (Microsoft’s steps). Ignore the “less secure apps” setting Microsoft’s page still mentions; Gmail no longer supports that kind of sign-in.

Google says iPhones and iPads on iOS 11 or later don’t need an app password either. On current iOS, go to Settings → Apps → Mail → Mail Accounts → Add Account, enter your Gmail address (choose Google if a list of providers appears), and follow the prompts (Apple’s steps). On older versions, Accounts is under Settings → Mail.

Older clients without OAuth, such as Outlook versions before Outlook 2016 or the volume-licensed MSI edition of Outlook 2016, need an app password and the values above.

Printers, scanners, NAS boxes, and scripts

A printer that scans to email, or a NAS that sends alerts, signs in to smtp.gmail.com with your full address and an app password. Google’s sending limits, as of September 2026:

For Workspace devices, Google’s printer and scanner help recommends the SMTP relay.

For your own scripts, Gmail’s servers also accept OAuth through SASL XOAUTH2: more work than an app password, but the route Google prefers. Gmail closes IMAP sessions after about 24 hours, so a long-running script has to reconnect.

Gmail app password not working? What to check

Check these causes:

1. You changed your Google Account password. Google revokes all your app passwords when the password changes. Create a new one for each app.
2. You enrolled in Advanced Protection. Enrolling revokes current app passwords, and new ones are blocked.
3. You turned off 2-Step Verification. Google says apps may show errors and recommends revoking your app passwords.
4. The app password was removed. After that, the app can’t sign in, though it may take a while to notice.
5. Your Workspace admin changed IMAP access. With IMAP off, or limited to OAuth mail clients only, app-password clients stop syncing even if they worked before.
6. Too many apps are connected. Gmail allows up to 15 email clients per account at a time (as of September 2026), and many clients syncing at once can cause a “Too many simultaneous connections” error.
7. You hit a Workspace bandwidth limit. Workspace accounts can download 2,500 MB a day over IMAP (as of September 2026). Past that, access is suspended, typically for an hour and up to 24 hours (Gmail bandwidth limits). Google publishes no figure for personal accounts.
8. You hit a sending limit from the table above. On personal Gmail the error reads “You have reached a limit for sending mail,” and Google says sending usually works again within 1 to 24 hours. On Workspace, sending can stay blocked for up to 24 hours.
9. The app is out of date. Google’s troubleshooting starts with updating the client, because older versions may not meet current security standards.

Error messages and what they mean

The SMTP texts below come from Google’s error reference, written the way apps usually print them. Google’s table formats the codes slightly differently.

• 535-5.7.8 Username and Password not accepted, “Invalid credentials,” or repeated password prompts: the app password is wrong or has been revoked. Create a new one, and check that the username is your full address.
• 534-5.7.9 Application-specific password required: usually the app sent your normal Google password on an account with 2-Step Verification. Use an app password.
• 534 “Please log in with your web browser and then try again”: sign in to your Google Account in a browser, then retry.

What an app password can access, and how to revoke it

An app password isn’t read-only, and Google offers no way to limit it to one app or one protocol. Whoever holds it can use IMAP, POP, and SMTP as you, reading and sending mail. Google’s transition guide names CalDAV and CardDAV (calendars and contacts) alongside the mail protocols where plain passwords were switched off, with app passwords as the exception, so an app password may reach those too. Treat it like your main password.

To revoke one (Google’s steps):

1. Open myaccount.google.com/apppasswords.
2. Find the app or device in the list.
3. Select Remove.

Google recommends revoking an app password when you lose a device or stop using an app. Changing your Google Account password revokes all of them at once.

Apple has its own version for iCloud Mail: see iCloud app-specific passwords and IMAP settings.

App password or Sign in with Google?

When an app has no Sign in with Google, Google names one other choice besides an app password: “Switch to a more secure app or device.”

Using a Gmail app password with CatchNone

CatchNone is a receive-only email alias app, available for iPhone, iPad, and Mac, that gives every signup its own address on your domain and reads the mail straight from your mailbox. If your domain’s mail lands in Gmail (say, a catch-all on your domain forwards there), an app password is all it needs: the mail goes from Google to your device and never passes through CatchNone’s servers, and each message is badged with the alias it reached. CatchNone connects with an app password rather than Sign in with Google. In the Add Mailbox form, set Connection type to IMAP, Mail server to imap.gmail.com, Email or username to your full Gmail address, and Password to the app password. Under Advanced settings, keep Port 993 and Secure connection (TLS) on, then use Test connection, because Save doesn’t test it. The password stays in that device’s Keychain and isn’t synced, so you enter it on each device.

CatchNone opens the mailbox read-only and never marks, moves, or deletes anything, though the app password itself would allow it. Each time you open it, it checks the newest 100 inbox messages from the last 30 days and picks out mail whose To, Cc, or Bcc names an address on your domain. It reads the inbox only, so Gmail Spam and mail your filters archive don’t appear. If Google won’t issue an app password, or your admin allows OAuth mail clients only, route the domain’s mail to a host with app passwords or JMAP tokens instead, such as iCloud+ or Fastmail (not its Basic plan, which has no IMAP or app passwords). Choosing an email provider for a custom domain compares the options.

FAQ

Does a Gmail app password expire?

Google’s help gives app passwords no time limit. They stop working for the reasons under Gmail app password not working?, such as a change of your Google Account password or enrollment in Advanced Protection.

Do I type the spaces?

Google’s help doesn’t describe how the code is shown; it calls it a “16-digit passcode.” Third-party guides updated in 2026 describe 16 characters in four groups of four, with the spaces there only for readability. Copy and paste the code rather than retyping it, and if the app rejects it, paste it again without the spaces.

Where is the app password setting in Gmail?

It isn’t in Gmail’s settings. It’s in your Google Account, at myaccount.google.com/apppasswords, or under Security & sign-in → How you sign in to Google → App passwords if your account shows that entry. If it doesn’t, use the direct link.

Can my Workspace admin create an app password for me?

Google documents no way for an admin to do that. Its admin help tells admins to have users create their own, in their own Google Account. Your admin’s part is allowing 2-Step Verification and IMAP access for any mail client.

Is an app password safe to use?

It’s a reasonable choice for an app that has no Sign in with Google, if you guard it like your main password. Google calls apps that need one “less secure” and recommends Sign in with Google where it’s offered. Because an app password can’t be limited, keep one per device and store it only in the app that needs it.