App Passwords for Email on Android: When You Need One

You open a third-party email app on your Android phone, enter your Gmail address and your normal password, and the connection fails. The app then asks for an app password — a 16-character code you have never seen before. This is not a bug, and it is not your password being wrong. It is a deliberate security mechanism, and understanding why it exists tells you when to use one and when to look for a better option.

This guide explains what an app-specific password is, how to generate one for the providers that still issue them, and what the security trade-off is — because it is a real one. It also covers why that trade-off often does not need to happen at all.

The short answer#

An app password is a generated credential that lets an email app sign in to your account using the older IMAP and SMTP protocols. When you have two-factor authentication enabled, your regular password alone is no longer enough — your account also expects a second factor. Older mail protocols have no way to pass that second step, so the authentication breaks.

An app password solves this by acting as a single credential that bypasses the 2FA check entirely. The provider generates a long, random string; you paste it into the email app; the app uses it in place of your password. From the protocol's point of view, the second factor was never involved.

The security implication is direct: anyone who gets hold of your app password can access your account without your phone or your authenticator code. That is the trade-off. For most people it is acceptable, as long as the app password is unique to that one app and can be revoked the moment you stop needing it. But it is worth making the choice consciously rather than by default.

What you need before you start#

Before generating an app password, check these three things. If any one of them is not in place, the generation step either will not appear or will not help.

• Two-factor authentication must be on. Every major provider requires 2FA before it will issue app passwords. If 2FA is currently off, IMAP may still accept your regular password, but that is a weaker posture. Enable 2FA first.
• Your provider must still support app passwords. Gmail, Outlook personal accounts, Yahoo, and iCloud still support them as of August 2026, but a Google Workspace administrator can disable app password generation for managed accounts. Check which account type you have before assuming the option will appear.
• IMAP must be enabled in your provider settings. Gmail has a toggle at Settings > See all settings > Forwarding and POP/IMAP. If IMAP is disabled, an app password will not help because the protocol is blocked regardless of what credential you use.

How to create an app password for Gmail on Android#

The steps below are for Gmail, the most common case on Android. You generate the password in a browser, not inside the email app itself — the app password is created in your Google Account and then pasted into the app.

1. 1

   Open your Google Account in a browser

   Go to myaccount.google.com and sign in if prompted. App passwords are managed here, not from inside the Gmail mobile app or Android settings.

2. 2

   Open Security settings

   In the left navigation panel, select Security. On a narrow screen, tap the menu icon first to reveal the panel.

3. 3

   Confirm 2-Step Verification is on

   Under How you sign in to Google, find 2-Step Verification. It must show as On. If it shows Off, enable it before continuing — the App passwords option will not appear on accounts where 2FA is disabled.

4. 4

   Find App passwords

   Use the search bar at the top of the Google Account page and type App passwords, then select the result. Alternatively, click directly on 2-Step Verification and scroll to the bottom of that settings page where App passwords is listed.

5. 5

   Name the app password

   In the App name field, enter something descriptive — for example, Android email or the name of the specific app you are setting up. This label is for your reference only and does not affect how the credential works.

6. 6

   Click Create

   Google generates a 16-character password shown in a yellow box. This is the only time you will see it. Copy it immediately — Google does not store it for you to retrieve later.

7. 7

   Paste it into your Android email app

   Return to your Android email app and paste the 16-character password into the password field. Do not type it manually — the characters are easy to misread. The app treats it exactly like a regular password from this point on.

8. 8

   Revoke it when you stop using the app

   If you remove the account or switch apps, go back to myaccount.google.com > Security > 2-Step Verification > App passwords and delete the entry. Revocation is immediate and cannot be undone.

Which email providers still support app passwords#

Not every provider handles app passwords the same way. The table below covers the five most common ones on Android as of August 2026. Verify against your provider's own support documentation before relying on any of this, as policies change.

The two ways to sign in — an app password over IMAP and OAuth — are not equivalent security choices. One goes around your second factor by design; the other preserves it.

What to do when an app password is not working on Android#

If you generated an app password and the email app still fails to connect, one of the following is usually the cause. Work through them in order before generating a new credential.

• Typed instead of pasted. The 16-character string has no spaces between groups on most providers, and some characters are easy to confuse — zero and the letter O, lowercase l and the number 1. Always paste rather than type.
• IMAP is disabled in Gmail settings. Open Gmail on the web, go to Settings > See all settings > Forwarding and POP/IMAP, and confirm IMAP access is enabled. A valid app password does nothing if the protocol is turned off.
• Wrong server settings in the app. Gmail IMAP server: imap.gmail.com, port 993, SSL. Gmail SMTP server: smtp.gmail.com, port 587, STARTTLS. Authentication errors and connection errors look identical inside most email apps — verify the server settings before assuming the credential is wrong.
• Managed or Workspace account. A Google Workspace administrator can disable app password generation for the whole organisation. If the App passwords option does not appear under your 2-Step Verification settings at all, this is the most likely explanation. Contact your IT administrator.
• 2FA was turned off after the password was generated. If 2FA was disabled on the account, all existing app passwords are revoked automatically by Google. Re-enable 2FA and generate a fresh app password.
• App password was already revoked. If you generated it in a previous session and it no longer appears in the App passwords list under your account, it was revoked. Generate a new one and update the email app.

A faster way: connect your account with OAuth instead#

If you are generating app passwords because a third-party app demanded one, it is worth checking whether that app is the right tool. Modern email clients connect via OAuth, which does not require a generated credential, does not bypass 2FA, and grants the app scoped access that can be revoked without changing your password.

AI Emaily connects to Gmail, Outlook, and other accounts over OAuth. You tap through Google's standard sign-in flow — no 16-character string, no manual IMAP server settings. On Android, AI Emaily runs as a PWA rather than a native app: you install it to your home screen from the browser, and it gets push notifications and offline reading from there. If a native Android app from the Play Store is what you need, that is worth knowing upfront. For everyone else, OAuth sign-in means one fewer generated credential to manage, and the connection can be revoked from your Google Account security settings at any time. We build AI Emaily, so read this as a recommendation with a disclosed interest.