Gmail Security: 2-Step Verification and App Passwords

If you have ever typed your Gmail password into Outlook or Thunderbird and been told it is wrong, nothing is wrong with your password. Google stopped accepting ordinary passwords over mail protocols. This guide covers the two things that replaced it — 2-Step Verification and app passwords — and how to set both up properly.

What changed, and why your password stopped working

Google spent several years removing what it called "less secure app" access: the ability for any program to connect to your account with just a username and password. That access ended for personal Gmail accounts in 2022, and for managed accounts in March 2025. Since then, connecting over IMAP, SMTP or POP with your ordinary password simply fails.

There are now two ways in. Either your mail client signs in through Google itself — the "Sign in with Google" flow, technically called OAuth — or, if it cannot do that, you give it a purpose-made app password instead. Modern clients almost all support the first. The second exists for everything that does not.

If your setup fails with 535 5.7.8 Username and Password not accepted, this is the reason, and no amount of retyping your password will change it.

Turn on 2-Step Verification

Everything here depends on 2-Step Verification, because app passwords are only offered once it is switched on. It is also, on its own, the single most effective thing you can do to protect the account.

1. Sign in to your Google Account.

2. Open Security & sign-in.

3. Under "How you sign in to Google", select 2-Step Verification.

4. Follow the prompts to add your second step.

Choosing a second step

Google offers several, and they are not equally good.

• Google prompts — a tap on a phone already signed in. Convenient, and resistant to someone intercepting a code.

• An authenticator app — six-digit codes generated on your device, working offline. A solid default.

• A security key or passkey — the strongest option, because it cannot be phished at all.

• Text messages — better than nothing, but the weakest choice. Codes sent by SMS can be intercepted, and phone numbers can be taken over by someone persuading a mobile operator to transfer them.

If SMS is your only option, use it — a weak second step still beats none. But add something stronger when you can.

Save your backup codes

During setup Google offers a set of one-time backup codes. Save them somewhere you will still be able to reach if your phone is lost, stolen or replaced — printed and filed, or in a password manager you can open from another device.

Storing them only on the phone that generates your codes defeats the point entirely. Backup codes are what stand between "I lost my phone" and "I lost my account", and account recovery without them is slow and uncertain.

App passwords

An app password is a 16-character code that lets one specific application into your account without using your real password. You need one only when the application cannot sign in through Google directly.

Do you actually need one?

Probably not, if your software is current. Most modern mail clients, phone mail apps and desktop programs support signing in with Google, which is both simpler and safer — it issues a limited token and never touches your password.

You need an app password when the software cannot do that. Typically:

• Older desktop mail clients that predate OAuth support

• Command-line and terminal mail tools

• Printers and scanners with a "scan to email" feature

• Network storage devices sending notification email

• Scripts and automation that talk raw SMTP

Creating one

1. Make sure 2-Step Verification is on. Without it, the option does not exist.

2. Go to your Google Account's app passwords page.

3. Give the app password a name you will recognise later — "Thunderbird laptop", "office scanner".

4. Create it, and copy the 16-character code shown.

5. Paste that code into the application where it asks for your password.

The code is shown once. If you lose it, delete that entry and generate a new one — there is no way to look it up again.

Name each one properly. In two years you will have several, and an unlabelled list gives you no way to tell which device you are revoking access from.

Three things that catch people out

Changing your main password revokes every app password. This is why mail clients all stop working at once after a password reset. It is deliberate — if someone had your password, they should not keep access through a side door. You will need to generate fresh app passwords for each device afterwards.

Work and school accounts may not offer them. An administrator can disable app passwords across an organisation, in which case the option never appears and OAuth is the only route.

An app password is not limited to one purpose. Despite the name, it grants broad access to your account. Treat it like a password: do not reuse one across devices, and delete entries for devices you no longer own.

How this relates to passkeys

Passkeys are a separate thing, and easy to confuse with the above. A passkey replaces your password when signing in to Google itself — you unlock your device instead of typing anything. An app password does the opposite job: it lets an old application authenticate when it cannot use any modern method.

You may well end up with both: a passkey for signing in day to day, and an app password for the scanner in the corner of the office that still speaks SMTP and nothing else.

Run Google's Security Checkup

Rather than hunting through settings pages one at a time, Google has a single tool that reviews the lot: Security Checkup, at myaccount.google.com/security-checkup. It walks you through your devices, recent security activity, third-party apps with account access, and your sign-in methods in one pass, flagging anything worth a second look.

Run it occasionally, and straight away if anything feels wrong. Three things deserve close attention while you are in there:

• Your devices — everywhere the account is currently signed in. Sign out anything you do not recognise.

• Third-party apps with account access — services you connected, sometimes years ago and possibly once. Remove what you no longer use.

• App passwords — delete entries for devices you no longer own.

Old access is the kind that gets forgotten and later exploited. A laptop you sold, a service that has since been breached, a printer that went to the recycler — each one is a door left open behind you. Closing them takes a couple of minutes a year, and Security Checkup puts all three lists in front of you at once.