Google retired “Less Secure Apps” for personal Gmail on May 30, 2022 and for Workspace on May 1, 2025. Any legacy SMTP, IMAP, or POP3 client that uses a username and password now needs an App Password instead. This DevAnswers guide walks through generating an App Password from your Google Account security settings, two configuration paths (Postfix and WP Mail SMTP), and the gotchas that cause “Invalid credentials” right after setup.
Prerequisites
App Passwords require 2-Step Verification on your Google Account. Without it, the option won’t appear in your security settings. Enable 2FA using a phone number, authenticator app, passkey, or security key. Note that accounts using security keys as their only 2FA method may not see the App Passwords option.
Generate a Gmail App Password
Open myaccount.google.com/apppasswords directly, or navigate to your Google Account → Security → 2-Step Verification → App Passwords (at the bottom of the page).
- In the App name field, type a label for this password (e.g.
WP Mail SMTPorPostfix relay). - Click Create.
- Google generates a 16-character password. Copy it immediately. You cannot view it again after closing the dialog.
abcd efgh ijkl mnop), but the spaces are only cosmetic. Paste the password without the spaces. Many SMTP clients (Postfix sasl_passwd, msmtp, etc.) and config files send whatever you paste literally; if spaces are present the server returns authentication failure even though the underlying credential is correct. If your client trims whitespace automatically it will still work either way, but stripping the spaces yourself is the safe default. Using Your App Password
Paste the 16-character password wherever the application asks for your Gmail password. Your full email address is the username. Two common server configurations follow.
WordPress SMTP
Install and activate a mail plugin such as WP Mail SMTP. In the plugin settings, choose the “Other SMTP” mailer and enter:
- SMTP Host:
smtp.gmail.com - Port:
587 - Encryption: TLS
- Username: your full Gmail address
- Password: the 16-character App Password
To avoid storing credentials in the database, define these values as constants in wp-config.php. Check your plugin’s documentation for the exact constant names.
Postfix Mail Relay
To relay outbound mail from a Linux server through Gmail, configure Postfix to authenticate with your App Password. Postfix needs SASL libraries to handle the authentication handshake:
sudo apt install postfix mailutils libsasl2-modulesCreate the SASL password file that maps Gmail’s SMTP endpoint to your credentials:
[smtp.gmail.com]:587 [email protected]:your-app-passwordSave and exit (press CTRL + X, press Y, then press ENTER)
Lock down the credentials file and build the indexed database that Postfix reads at runtime:
sudo chown root:root /etc/postfix/sasl_passwd
sudo chmod 600 /etc/postfix/sasl_passwd
sudo postmap /etc/postfix/sasl_passwd
sudo chown root:root /etc/postfix/sasl_passwd.db
sudo chmod 600 /etc/postfix/sasl_passwd.dbsasl_passwd file stores your App Password in plaintext. Restrict ownership to root, keep it out of backups and version control, and consider a secrets manager if this is a production relay. Add the relay configuration to main.cf so Postfix routes all outbound mail through Gmail’s SMTP server:
relayhost = [smtp.gmail.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = encrypt
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crtSave and exit (press CTRL + X, press Y, then press ENTER)
Restart Postfix and send a test email to confirm the relay works. Replace [email protected] with a real email address you control:
sudo systemctl restart postfix
echo "Test from Postfix" | mail -s "Postfix Relay Test" [email protected]If the message doesn’t arrive, check /var/log/mail.log (or run journalctl -u postfix on newer systems like Debian 12 and Ubuntu 24.04, where rsyslog is not installed by default). Common causes include an incorrect App Password, a missing SASL library (libsasl2-modules), or a firewall blocking outbound port 587.
Troubleshooting
“App Passwords” option is missing. 2-Step Verification is not enabled, or your Google Workspace administrator has disabled the feature. Enable 2-Step Verification first, then check with your Workspace admin if the option still doesn’t appear.
“Invalid credentials” or “Authentication failed.” Confirm you’re using the 16-character App Password, not your regular Google password. Check that the username is your full email address and that no extra spaces were copied. If the error persists, revoke the password and generate a new one. Our guide to fixing Gmail invalid credentials covers this in detail.
“Application-specific password required.” The application is sending your regular Google password instead of an App Password. Generate one using the steps above, or see our guide to the “application-specific password required” error.
2FA is enabled but the option is still missing. Two less obvious causes: if you enrolled in Google’s Advanced Protection Program, your existing App Passwords are revoked and you cannot create new ones; Google’s help docs list Advanced Protection as one of the reasons the option won’t appear in your security dashboard. If your account uses only security keys for 2FA (no phone or authenticator app), Google also hides the option.
Revoking App Passwords
Revoke any App Password individually from the same App Passwords page. Click the trash icon next to the password name. Revocation disconnects that specific application without affecting your other passwords or your main login.
Generate a separate App Password for each application. If a device is lost or compromised, you can revoke that single password without disrupting everything else.
Conclusion
App Passwords are the standard authentication for legacy SMTP, IMAP, and POP3 clients that don’t support OAuth 2.0; printers, scanners, mail relays, older mail clients. For modern desktop clients with Sign-in-with-Google support, prefer that path; the Less Secure Apps decision guide covers when each option fits.
If authentication errors appear after setup, the troubleshooting steps above cover the most common fixes. For the specific “application-specific password required” error, that diagnostic walkthrough goes deeper. And if you have 2FA enabled but the App Passwords option still does not appear, the invalid credentials guide covers the legacy-error context.
where do I find the generater to make the password?
I was hacked and now I can’t get into my g-mail with out doing a account restore.
all I need is the program to make the password.
Thanks
Bon
Is it possible to generate the App Password via an API call?
This^ Did you ever find an answer to this problem?
Do you know if there’s a limit as to how many app passwords can be created for an email account? I don’t see anything in Google’s documentation.
brilliant! The authorization step at the end is the bit I was missing, just followed the link and it now works. Thank you! Very happy!
I can say this DOES work. Do not use the spaces generated in password. These spaces are iD10 spaces (sorry) for error proof entering.
BUT!!
My issue is to differentiate 3 separate app passwords for 3 separate apps for the same gmail email account that all land to the said account looking as if it came from the same entity…..What I Need Is an App Specific AppPassword to differentiate its’ origin.
Can you please help with that?
On some rare occasions, I want my Python app on a Raspberry Pi to send me a message using my GMail account as the SMTP service. This works currently, except that Google automatically disables the app’s access to GMail after a certain time. If I do not “catch” this event, and manually restore the app’s permissions, then I do not receive these rare but important messages from my Raspberry Pi.
Google has implied that configuring one’s account to use 2FA will also enable one to generate an app password. Google further implies that this app password will avoid the problem I describe in the first paragraph, but this is a rather vague assurance because it’s stated here that the app will get “restricted access“. Google has also been known to terminate services and features for various reasons. All of this uncertainty leads me to wonder if I’m merely an unknowing participant in an experiment, or if this 2FA and app password will solve my current problem.
And so I have some questions:
Is the use case I described in the first paragraph one that would be allowed under Google’s definition of “restricted access“?
Are the 2FA and “app password” services ones that are likely to be somewhat durable elements in Google’s efforts toward security?
If I change my GMail account to use 2FA, and subsequently decide that it doesn’t suit me, can I revert to the current userid & password scheme I have now?
Thanks for your time.
Hi Séamus,
I assume you have you done this step? Allow less secure apps to access your Gmail account.
I’m not surprised if Google is blocking the RasPi periodically if you are using your main Google Account password to authorise SMTP. Google login security isn’t as lax as it once was.
You should try setting up 2FA and then give your RaspPi an app password, which should relax Google’s login security for the RaspPi. Personally I use Postfix to access Gmail SMTP without issues: How to configure Postfix to use Gmail SMTP on Ubuntu
The whole point of an app password is that it restricts access to your Google account so if your app password is ever compromised, your entire Google account cannot be hijacked.
And, yes, you can disable 2Fa and revert back to the old method if needed.
then app password created ???. Even When i login using email and app generated password, still got incorrect password. Where should i use it ?? or should i change password with it??. I didnt understand after this processs
You may have a security block on your account. Go to this page to enable access to your Google Account.
https://accounts.google.com/DisplayUnlockCaptcha
I forgot my gmail password can you plz help me
No, it doesn’t work. Google rejects the 16-digit pass code it has just generated.
same here, unfortunately
You may have a security block on your account. Go to this page to enable access to your Google Account.
https://accounts.google.com/DisplayUnlockCaptcha