Gmail does not let most websites and scripts sign in with your normal Google password. Instead, you create an App Password: a 16-character code that lets one app send email through your Gmail account.
What you need to know in 10 seconds
- What: a 16-character password for one app or website
- Needed for: Gmail SMTP in PHPMailer, website contact forms, WordPress SMTP plugins and older email apps
- Requirement: 2-Step Verification must be ON in your Google account
- Where: myaccount.google.com/apppasswords
Step 1: Turn On 2-Step Verification
App Passwords only work when 2-Step Verification is turned on. If it is off, open your Google Account, go to Security, and turn on 2-Step Verification first.
Step 2: Create the App Password
- Go to myaccount.google.com/apppasswords and sign in
- Type a name for the app, for example My website contact form
- Click Create
- Copy the 16-character password that Google shows you
- Paste it into your app or script, then click Done
Save it right away
Google shows the App Password only once. Copy it into your app or a password manager before you close the window. Never share it or publish it in your code on GitHub.
Step 3: Use These Gmail SMTP Settings
Use your App Password with these settings in PHPMailer, WordPress SMTP plugins or any email app:
- SMTP server: smtp.gmail.com
- Port: 587 with TLS (or 465 with SSL)
- Username: your full Gmail address
- Password: the 16-character App Password (without spaces)
- Authentication: ON
Using PHP? Follow our step-by-step PHPMailer with Gmail tutorial to send your first email.
Why You Can't Find "App Passwords"
Google says the option may be missing when:
- 2-Step Verification is not turned on
- 2-Step Verification is set up only with security keys
- You use a work, school or organization account
- Your account uses Advanced Protection
For a work or school account, ask your administrator.
Common Problems and Fixes
It stopped working
Did you change your Google password? That removes all App Passwords. Create a new one and update your app.
Authentication failed
Check that you use the App Password, not your normal password, and your full Gmail address as the username.
Connection timed out
Try port 587 with TLS. Some hosting companies block SMTP ports, so ask your host if it still fails.
Remove an old password
Go to the App Passwords page and click Remove next to the app you no longer use.
Is an App Password Safe?
An App Password gives one app access to your Google account, so treat it like a real password. Google itself says App Passwords "aren't recommended" when an app offers Sign in with Google, so use that option when it exists. For scripts and contact forms that only support SMTP, an App Password is the standard solution.
If you lose a device or stop using an app, remove its App Password.
Frequently Asked Questions
What is a Gmail App Password?
It is a 16-character password that lets one app or website use your Gmail account, for example to send emails through Gmail SMTP.
Why can't I see the App Passwords option?
It is missing when 2-Step Verification is off or uses only security keys, when you use a work or school account, or when your account has Advanced Protection.
What are the Gmail SMTP settings?
Server smtp.gmail.com, port 587 with TLS or 465 with SSL, your full Gmail address as username, and the App Password as password.
