Less Secure App Access Is Gone: How to Connect Gmail Now

Gmail's less secure app access is turned off permanently. If your email client, scanner, or script lost its Gmail connection sometime in 2024 or 2025 with no change on your end, that is the cause. Google removed the setting that allowed older applications to sign in using only a username and password, and there is no way to re-enable it. Consumer Gmail accounts lost password-only IMAP and SMTP access in September 2024; Google Workspace accounts followed on March 14, 2025, when basic authentication was permanently cut off across all protocols including IMAP, SMTP, POP, CalDAV, and CardDAV.

The fix depends on what broke. Most modern email clients already support Sign in with Google (OAuth 2.0), which replaces the old password with a secure token Google generates and manages. Devices and scripts that cannot speak OAuth — network scanners, NAS boxes, legacy IMAP clients, cron jobs that authenticate directly to smtp.gmail.com — use a Gmail App Password instead: a 16-character credential you generate once from your Google Account and enter in place of your main password.

This guide explains what changed, helps you identify which fix applies to your situation, walks through both paths step by step, and covers the failure modes that catch most people after the first attempt.

Before you start: identify which fix applies to you#

The right path depends entirely on what you are connecting. Open the account-setup or SMTP-configuration screen in the client or device. If it shows a button labeled Sign in with Google, or any prompt that redirects you to a Google login page, take that path. You do not need an App Password, and going through the App Password steps would add unnecessary complexity.

If the only options are a username field and a password field with no Google sign-in button anywhere in the interface, you are on the App Password path. Common situations that land here: network printers and scanners using scan-to-email over SMTP, NAS devices such as Synology and QNAP using built-in mail-relay or notification features, legacy email clients that expose raw IMAP or SMTP configuration, and scripts or cron jobs that authenticate directly to smtp.gmail.com with a stored credential.

One prerequisite applies to the App Password path before anything else: 2-Step Verification must be active on your Google Account. If it is off, the App Passwords option does not appear anywhere in your settings. The page at myaccount.google.com/apppasswords will either redirect you to the security enrollment flow or show a message saying the feature is not available for your account. Google Workspace accounts have a second gate: the administrator must have App Passwords enabled in the Admin console. If you are on a managed Workspace account and cannot find the option even after enabling 2-Step Verification, check with your IT team before spending time troubleshooting the client.

How to reconnect Gmail: step by step#

If your client or device supports OAuth, the process is removing the broken account and re-adding it with the Sign in with Google option. Google handles token issuance and renewal; you never enter a password. The numbered steps below cover the App Password path for clients and devices that have no OAuth option.

1. 1

   Confirm 2-Step Verification is on

   Go to myaccount.google.com/security. Under 'How you sign in to Google,' check that 2-Step Verification shows as On. A phone number added to your account is not the same thing as having 2-Step Verification active — a second factor such as an authenticator app, a hardware key, or backup codes must be fully enrolled. If it shows Off or Partially set up, click through the enrollment flow. Return here once 2-Step Verification is confirmed On.

2. 2

   Open the App Passwords page

   Navigate directly to myaccount.google.com/apppasswords. Google will ask you to re-enter your account password and complete a 2-Step Verification challenge before showing you the list. This re-authentication happens every visit, not only on first setup. If the page redirects you away or shows a 'this option is not available' message, 2-Step Verification is not fully active, or your Workspace administrator has disabled App Passwords for your organisation.

3. 3

   Name and generate the App Password

   In the text field labeled 'App name,' type a label that identifies exactly what this credential is for — for example 'HP OfficeJet scanner,' 'Thunderbird on laptop,' or 'Synology NAS mail relay.' Google does not validate the name; it exists for your own reference when you later need to revoke a specific code from the list. Click Create. A dialog displays a 16-character code. This is the only time you will ever see it. Copy it to a password manager or the device configuration screen before you dismiss the dialog — it cannot be retrieved afterward.

4. 4

   Enter the App Password in the client or device

   In the email, IMAP, or SMTP settings of the client or device, use your full Gmail address (for example [email protected]) as the username. In the password field, enter the 16-character code without spaces. Google sometimes displays the code in four groups of four characters for readability, but the actual credential is a single contiguous string. Strip any spaces before pasting it into the device settings. Save the configuration.

5. 5

   Set the correct server and port

   For incoming IMAP mail, use imap.gmail.com on port 993 with SSL/TLS. For outbound SMTP mail, use smtp.gmail.com on port 587 with STARTTLS or port 465 with SSL/TLS. Do not use port 25 — Google blocks it for outbound mail on all connections regardless of the credential type. Older devices often default to port 25; changing it resolves connection-timeout errors that look identical to credential failures.

6. 6

   Test the connection and verify

   Run the device's built-in connection test, or trigger a test scan or test email. If the first attempt fails, check the server name and port before anything else, then verify the App Password contains no spaces. If the settings look correct and the credential still fails, generate a fresh App Password — a partially copied or space-padded code is the most common cause of an initial failure, and retrying a bad code gives an error indistinguishable from a correct code that has been revoked. Go to myaccount.google.com/apppasswords, click the X next to the old entry, and generate a new one.

Which connection method does your client or device need?#

The table below maps common clients and device types to the appropriate authentication method. 'OAuth' means clicking Sign in with Google in the app — no SMTP or IMAP configuration required. 'App Password' means generating a 16-character code and entering it as the password in the client's IMAP or SMTP settings. Google Workspace accounts may override either column: an administrator policy controls which connection methods are available, and the effective policy setting wins over anything you configure at the account level.

What to do when the connection still fails#

Most failures after following the steps above trace back to one of a short list of causes. Work through these in order before generating a new credential or changing the client configuration.

• The App Passwords option is not appearing at all: 2-Step Verification is off or incompletely enrolled. Adding a phone number to your account is not the same as having a second factor active — an authenticator app, hardware key, or backup codes must be fully set up. Go to myaccount.google.com/security and confirm the 2-Step Verification row shows On, not Partially set up.
• On a Workspace account the option is blocked even after enabling 2-Step Verification: the Workspace administrator has disabled App Passwords in the Admin console under Security settings. You cannot work around this from within your own account; the administrator must adjust the policy before you can generate a credential.
• The client rejects the connection with error 550 5.7.26: this is the specific error Gmail returns when a client sends a plain password rather than an OAuth token or a valid App Password. It does not mean the App Password you generated is wrong — it means the client is still using your old main Gmail password. Update the password field in the client settings to the 16-character App Password.
• Spaces in the code: Google displays the App Password with spaces between groups of four characters for readability. The actual credential contains no spaces. Paste the code into a plain-text editor to strip formatting, then copy it cleanly into the device settings.
• Wrong Google account: if you manage multiple accounts, the App Password must come from the same account whose email address you entered as the username. A code generated on one account cannot authenticate another.
• Port 25 is configured as the SMTP port: Gmail blocks port 25 for all outbound mail regardless of the credential. Change the outbound SMTP port to 587 with STARTTLS or 465 with SSL/TLS. Port-25 failures show as a connection timeout rather than an authentication error, which is why they are easy to misdiagnose.
• Google temporary security hold: if Google detects a sign-in attempt from an unfamiliar device or location, it may block the connection until you review a security alert. Visit myaccount.google.com/security, review any recent security events under 'Your devices' or 'Recent security activity,' confirm the activity was yours, then retry the connection.

A faster way to connect Gmail to an AI email client#

If the reason your Gmail connection broke is that you are trying to reach it from a third-party client for drafting, triage, or inbox automation, there is a simpler path. We build AI Emaily, an AI-native email client that connects to Gmail through the standard Google OAuth flow — no App Password, no manual SMTP configuration, no 16-character code to copy and store.

The connection takes one click on the Google sign-in screen. AI Emaily requests only the Gmail scopes it needs, and the access is revocable from your Google Account security page at any time. Drafting and triage run in three modes — Manual (you write and send every reply), Copilot (AI drafts and you approve before anything goes out), and Autopilot (AI sends within rules you define). Voice matching in drafts draws from a user-set Personal Context brain and per-contact profiles, not from scanning your past mail.

If reconnecting Gmail without app passwords and getting AI assistance on inbox overhead are both on the list, there is a 7-day free trial on Pro and Autopilot plans.