How to Create an App Password for Gmail (and When You Still Need One)

How to create an app password for Gmail is a question that should immediately prompt a second question: do you actually need one? For most people connecting a modern email client or app, the answer is no. Sign in with Google (OAuth) is faster, more secure, and requires none of this setup. App passwords exist specifically for the case where a device or service cannot speak OAuth at all — network printers, older IMAP clients, scan-to-email hardware, and scripts that authenticate to Gmail over SMTP with a plain username and password.

If the app or device you are trying to connect offers a Sign in with Google button or an OAuth flow, use it and stop here. If it asks only for a username and password with no OAuth option in sight, the four-minute procedure below is what you need.

What you need before you start#

Google requires 2-Step Verification to be active on your account before the app passwords option appears anywhere in your settings. This is not a configuration choice — it is a hard dependency. If 2-Step Verification is off, the app passwords page at myaccount.google.com/apppasswords will either redirect you to the security enrollment flow or show an error message. The option is hidden by design until the prerequisite is met.

Google Workspace accounts add a second gate: your administrator must explicitly allow app passwords in the Workspace Admin console. Even if your personal 2-Step Verification is on, a Workspace policy can suppress the option entirely. If you are on a managed Google Workspace account and cannot find app passwords after enabling 2-Step Verification, your IT administrator needs to review the policy before you troubleshoot the client configuration.

How to create a Gmail app password: step by step#

The process takes about four minutes. Have your authenticator app, hardware key, or a backup code ready because Google will ask you to complete a 2-Step Verification challenge partway through.

1. 1

   Confirm 2-Step Verification is on

   Go to myaccount.google.com/security. Under the section labeled 'How you sign in to Google', look for '2-Step Verification' and check that it shows as On. If it is off, click it and follow the enrollment steps — you will need a phone number, an authenticator app, or a hardware key. Come back to this guide once 2-Step Verification is active.

2. 2

   Open the app passwords page

   Navigate directly to myaccount.google.com/apppasswords. Google will prompt you to re-enter your password and complete a 2-Step Verification challenge before showing you the list. This re-authentication happens every time you visit the page, not just on first setup.

3. 3

   Name the app password

   You will see a text field labeled 'App name'. Type a label that tells you exactly what this credential is for — for example, 'HP OfficeJet 8035 scanner', 'Synology NAS mail relay', or 'Thunderbird laptop'. Google does not validate or use this name; it exists purely for your reference when you later need to revoke a specific code from the list.

4. 4

   Click Create and copy the code immediately

   Google generates a 16-character password displayed in a yellow dialog box. This is the only time you will ever see this code. Do not close the dialog until you have copied it somewhere safe — a password manager, the device settings screen, or a temporary note. Once the dialog is dismissed, the code is gone and cannot be retrieved.

5. 5

   Enter the code in the device or app

   Open the email, SMTP, or scan-to-email configuration in the device or application. Use your full Gmail address (for example, [email protected]) as the username. In the password field, type or paste the 16-character code without spaces — some password dialogs display the code with spaces for readability, but the actual credential has none. Save the configuration.

6. 6

   Test the connection

   Use the device's built-in connection test, or send a test scan or email, to confirm the credential works. If the first attempt fails, generate a fresh app password rather than reusing the original — it cannot be retrieved, and entering a partial or space-padded code is the most common reason for an initial failure. Once the connection succeeds, the setup is complete.

Which platforms still need a Gmail app password?#

Fewer platforms than you might expect. Google has pushed hard toward OAuth because it is safer — scoped to specific permissions, revocable from your Google Account at any time, and tied to a signed-in session rather than a static string. Most major email clients added OAuth support several years ago. The table below is the honest breakdown of where an app password remains the practical path and where it is now the wrong choice.

What to do when an app password does not work#

The most common cause of failure is the app passwords option not appearing in your Google Account at all. This almost always means 2-Step Verification is either off or only partially configured — a phone number added but no second factor actually enrolled, for instance. Go directly to myaccount.google.com/security and confirm that 2-Step Verification shows as active, not just started.

If you can generate the code but the device or app rejects it, work through these causes in order before generating a fresh code:

• Spaces in the password: Google sometimes displays the 16-character code with spaces for readability (four groups of four). The actual credential contains no spaces. Strip every space before entering it in the device, or use a password manager to paste it cleanly.
• Wrong Google account: if you manage multiple accounts, confirm the app password was generated from the same account whose address you typed as the username. A code from one account cannot authenticate another.
• SMTP port mismatch: Gmail's outbound SMTP server is smtp.gmail.com on port 587 with STARTTLS or port 465 with SSL/TLS. Port 25 is blocked by Google for outbound mail regardless of the credential. Older devices sometimes default to port 25 — change it and the invalid-credentials error disappears.
• Workspace policy block: on managed Google Workspace accounts the administrator can disable app passwords or restrict which third-party apps may connect. The error typically surfaces as 'application not enabled' or a redirect rather than 'invalid credentials'. Only the Workspace admin can resolve this.
• Code dismissed before copying: a code you generated and closed without copying is gone. Generate a new one — there is no way to retrieve the original after the dialog is dismissed.
• Temporary Google security hold: if Google detects a new sign-in from an unusual location or device, it may block the connection until you clear a security alert. Go to myaccount.google.com/security, review any recent security events, and confirm the activity before retrying.

A faster way to connect Gmail to an AI email client#

If the reason you are generating an app password is to connect Gmail to a third-party client for AI drafting, triage, or inbox automation, there is a simpler path. We build AI Emaily, an AI-native email client that connects to Gmail through the standard Google OAuth flow — no app password, no SMTP configuration, no 16-character code to store.

The connection takes one click on the Google sign-in screen. AI Emaily requests only the Gmail scopes it needs, and the access is revocable from your Google Account at any time. Autonomous drafting and triage run through three operating modes — Manual (you send every reply), Copilot (AI drafts, you approve before anything goes out), and Autopilot (AI sends within rules you define) — so the credential never does more than you have explicitly authorised. Voice matching in drafts comes from a user-set Personal Context brain and per-contact profiles, not from scanning your past mail.

AI Emaily pricing includes a 7-day free trial on Pro or Autopilot. If connecting Gmail without this setup and getting AI help on the inbox overhead are both on the list, that is a practical place to start.