An app password is a 16-character code Google generates so a device or program that can’t use “Sign in with Google” can still send mail through smtp.gmail.com. Copiers, scanners, accounting programs and website plugins are the usual users. Your regular Google password no longer works for them: Google Workspace accounts stopped accepting password-only (“less secure app”) sign-in on May 1, 2025, the date in Google’s latest announcement, and personal Gmail accounts had already lost that option.
Three questions pick the fix. Does the device offer Google or OAuth sign-in? Use it and skip the app password. Is 2-Step Verification on? Without it, there’s no app password option. Is this a Google Workspace office with several devices? The SMTP relay service, which trusts your office’s IP address instead of a password, is usually cleaner.
Try these first
- Turn on 2-Step Verification for the sending account; app passwords don’t exist without it.
- Create a code at myaccount.google.com/apppasswords and enter it where the device asks for a password.
- Use smtp.gmail.com, port 587 with TLS/STARTTLS or port 465 with SSL, and the full email address as the username.
- Changed the Google password recently? That revoked every app password on the account; make a new one.
- No App passwords link? Go straight to myaccount.google.com/apppasswords; if it’s unavailable, check for security-key-only sign-in, Advanced Protection or a work account policy.
- Google Workspace with several copiers: set up smtp-relay.gmail.com with your office IP instead.
The Gmail SMTP settings, and what each error means
Enter these on the device’s SMTP settings page or in the program’s outgoing mail settings.
| Setting | Value |
|---|---|
| SMTP server | smtp.gmail.com |
| Port and encryption | 587 with TLS (often labeled STARTTLS), or 465 with SSL |
| Authentication | On; often a checkbox such as “SMTP authentication” or “server requires authentication” |
| Username | The full address, such as scans@example.com or yourname@gmail.com |
| Password | The app password, not your Google password |
| From or sender address | The same address you signed in with |
Keep the port and encryption as a pair. If the device sends from a different address than its sign-in, Gmail may swap in the signed-in account unless that address is set up under Send mail as.
Reading the error on the device or in the program’s log
| Message you see | What it means | Fix |
|---|---|---|
535 Username and Password not accepted | Wrong or revoked app password, a username other than the full address that created it, or the regular Google password | Create a new app password and enter it with the full address |
534 Application-specific password required | 2-Step Verification is on and the device sent the normal password | Use an app password |
534 5.7.14 Please log in through your web browser and then try again | Google blocked the sign-in as unusual | Sign in to Gmail on the web, review any security alert, then retry |
454 4.7.0 Too many sign-in attempts, try again later | Repeated failed sign-ins, often a device retrying a wrong password | Correct the password on the device, then wait before sending again |
530 5.7.0 Must issue a STARTTLS command first | Encryption is off while using port 587 | Turn on TLS/STARTTLS |
530 5.7.0 Authentication required | The device is trying to send without signing in | Turn on SMTP authentication and enter the username and app password |
550 5.4.5 Daily user sending limit exceeded | Over Gmail’s daily limit: Google cites about 500 messages for personal accounts and 2,000 through smtp.gmail.com for Workspace | Wait up to 24 hours, spread batches out, or on Workspace use SMTP relay |
| Timeout or “cannot connect” | Wrong port and encryption pair, a firewall or web host blocking outbound mail ports, or an old device that can’t do modern encryption | Try the other pair, check the firewall or ask the host, update the device firmware |
If small scans arrive but big ones never do, that’s a size limit rather than a sign-in problem; see why Gmail won’t send large attachments.
Create the app password, one per device
- Sign in to the Google account the device will send from. In your Google Account, open Security & sign-in and, under How you sign in to Google, confirm 2-Step Verification is on.
- Go to
myaccount.google.com/apppasswords. Google may ask you to sign in again. - Type a name that identifies the device, such as “Front desk copier”, and create the password.
- Copy the 16-character code now; Google shows it only once. Enter it in the device’s password field without the spaces between the groups of four, since some devices count them, with the full address that created it as the username. Save and send a test scan.
Give every device and program its own app password, so when a copier is replaced or a laptop goes missing you click Remove next to that one entry and nothing else breaks.
Changing the account’s password revokes all its app passwords, so a reset after a phishing scare quietly stops every scanner using it. And an app password gets past 2-Step Verification, so don’t email it or tape it to the copier.
For Outlook, Apple Mail or another mail app rather than a device, our guide to fixing “email authentication failed” covers mail-app sign-in.
App passwords option missing? The usual reasons
Don’t rely on the menu: the App passwords entry often isn’t listed under Security & sign-in even when the account qualifies. Open myaccount.google.com/apppasswords directly or search “app passwords” in your Google Account. If it says the setting isn’t available, one of these explains it.
| Reason | How to tell | What to do |
|---|---|---|
| 2-Step Verification is off | The 2-Step Verification entry under Security & sign-in says it’s off | Turn it on, then reopen the app passwords page |
| 2-Step Verification is set up only with security keys | A physical key is your only second step | Personal account: adding another second step, such as an authenticator app, may bring it back, though that gives up some of the keys’ phishing protection. Work account: an admin decision, below |
| Advanced Protection is on | The account is enrolled in Google’s Advanced Protection Program | App passwords are blocked, and enrolling revokes existing ones. Use a device whose Google sign-in is a verified app (only those reach the account’s data), or a separate account used only for the device, never the protected one |
| A work or school account | The address belongs to your organization’s Google Workspace | Ask the admin to check the settings below or set up SMTP relay |
For Google Workspace admins
Two settings decide whether staff can create app passwords, both under Menu > Security > Authentication > 2-step verification in the Admin console (super admin required). Users can’t enroll unless Allow users to turn on 2-Step Verification is checked for their organizational unit. And setting enforcement Methods to Only security key turns app passwords off for those users by design.
Both settings can differ by organizational unit. If you require security keys, keep that policy and send devices through the SMTP relay below. Moving a device account into a weaker-policy unit so it can use an app password is a security exception; do it only with the policy owner’s agreement, and use that account only for the device’s mail.
Google Workspace alternatives: SMTP relay and the restricted server
Google documents three ways for Workspace devices and programs to send mail; the relay and the restricted server can trust the device’s IP address instead of a password.
| Option | SMTP relay service | Gmail SMTP server | Restricted Gmail SMTP server |
|---|---|---|---|
| Server | smtp-relay.gmail.com | smtp.gmail.com | aspmx.l.google.com |
| Ports | 25, 465 or 587 | 465 (SSL) or 587 (TLS) | 25 only |
| How it trusts the device | Your office’s IP address, or a Workspace sign-in over TLS | Full address plus app password | No sign-in; the device’s IP is allowlisted |
| Can send to | Anyone | Anyone | Only Gmail and Google Workspace addresses |
| Daily limit | Up to 10,000 recipients per user | 2,000 messages | Normal Workspace per-user limits |
Setting up SMTP relay
- In the Admin console, go to Menu > Apps > Google Workspace > Gmail > Routing. You need the Gmail Settings administrator privilege, and the rule can only be added at the top-level organization.
- Scroll to SMTP relay service and click Configure.
- Under Allowed senders, choose Only addresses in my domains if the device sends as an address that isn’t a licensed user, such as scans@example.com; otherwise choose Only registered Apps users in my domains. Avoid Any addresses, which Google doesn’t recommend.
- Check Only accept mail from the specified IP addresses and add your office’s public IP. Also check Require TLS encryption unless the device can’t do TLS; Google then rejects anything sent unencrypted.
- Click Save; changes can take up to 24 hours.
- On the device, set the server to
smtp-relay.gmail.com, port587with TLS, and leave SMTP sign-in off if you’re relying on the IP address. Give any HELO/EHLO or hostname field a unique name such ascopier1.example.com; Google can refuse an empty or invalid one.
IP allowlisting needs a static public IP, so check with your internet provider. If yours changes, use Require SMTP Authentication instead: it needs TLS and has the device sign in as a Workspace user, so expect an app password if that account has 2-Step Verification. Without TLS, ports 25, 465 and 587 all work, but only with IP authentication.
With IP-only trust, any computer on your office network, malware-infected ones included, can send through the relay as your domain. Google advises keeping the IP range as small as possible: list only your office’s public IP and keep Allowed senders to your domains.
A 550 5.7.1 “Invalid credentials for relay” bounce means the device’s IP doesn’t match the one registered for your domain, or the sender address isn’t in your domains.
The restricted server needs the device’s IP on the Gmail allowlist in the Admin console and in your SPF record. Some internet providers block outbound port 25, which rules it out.
A device that can’t encrypt sends scans across the internet in the clear on either route, so keep tax forms, IDs and other sensitive client records off it and replace it soon.
Rather have a technician sort it out?
If a copier, scanner or app still won’t send through Gmail, a technician can connect remotely and set up the app password, SMTP settings or Workspace relay with you. A GoProIT technician can connect remotely, with your permission, and fix it while you watch. $59 per fix, Mon–Fri 8am–8pm ET.
Less secure apps are gone: what changed and when
Old setup guides say to turn on “Allow less secure apps”. That setting no longer exists. Google switched it off for most personal accounts in 2022 and removed it from the Workspace Admin console in 2024. Google Workspace accounts stopped accepting password-only (“less secure app”) sign-in on May 1, 2025, the date in Google’s latest announcement after earlier dates were postponed. That covers a plain username and password from third-party apps and devices over IMAP, POP and SMTP.
A scanner or program that used to sign in with the regular password now needs OAuth (often a Google account option in newer firmware), an app password or the relay. When you replace a copier, pick one that sends with OAuth and the chore goes away.
Which option fits your office
| Your situation | Best option | Why |
|---|---|---|
| Personal Gmail and one scanner or program | App password on smtp.gmail.com | No admin console needed; one code per device is easy to manage |
| Workspace, several copiers at one office with a static IP | SMTP relay with IP allowlisting | No passwords stored on devices, so a password reset can’t stop scanning |
| Workspace, old device without encryption | SMTP relay with IP allowlisting, then plan a replacement | The relay takes unencrypted mail from an allowlisted IP and delivers anywhere; the restricted server reaches only Gmail and Workspace addresses |
| Website form, CRM or invoicing tool sending as your domain | Relay, or the tool’s own sending service with SPF and DKIM set up | Mail sent as your domain from someone else’s server can land in spam or bounce with a 5.7.26 error unless that service signs with DKIM for your domain (plus an SPF include if its setup guide asks for one) |
| Office on Microsoft 365 rather than Google | Microsoft’s options | See scan to email with Office 365 |
If a device or program sends fine but messages to Gmail addresses bounce with 550 5.7.26, sign-in is no longer the problem; your domain’s authentication records are. See how to fix 550 5.7.26 bounces.
Keep a list of which device uses which account and app password, so you know what to rotate when someone leaves. Relay setup, 2-Step Verification policies and device accounts are part of our Google Workspace management.
When to stop and get help
- The device’s firmware can’t do TLS or OAuth and has no update; the choices are a relay, the restricted server, or replacing it.
- Your office has no static IP and the device can’t do SMTP authentication over TLS.
- You find app passwords nobody created, or security alerts for sign-ins you don’t recognize. Remove them, change the password and look for other signs of a break-in; see how to tell if your business has been hacked.
- Your admin enforces security keys and several departments need devices that send mail.
Getting a copier or program sending through Gmail again is a typical $59 remote fix if you’d rather hand it off. You approve the session and can end it at any time; be ready to sign in to the Google account yourself and to open the device’s web settings page.
Common questions
What is the SMTP server for Gmail?
It’s smtp.gmail.com. Use port 587 with TLS (STARTTLS) or port 465 with SSL, turn on authentication, and enter the full email address as the username. Unless the device supports signing in with Google, the password field takes an app password. Google Workspace organizations also have smtp-relay.gmail.com, which can trust the office’s IP address so devices don’t store any password.
Why is my Gmail app password not working?
Most often the account’s Google password changed after you created it, which revokes every app password on the account. Other common causes are a username that isn’t the full address that created the code, spaces typed into a device that counts them, or a port and encryption mismatch: use 587 with STARTTLS or 465 with SSL. If it still fails, remove the entry, create a new one and send a test.
Do Gmail app passwords expire?
Google’s help doesn’t give them an expiry date. In practice they stop working when you remove them on the app passwords page, or when the account’s Google password changes, which revokes them all at once. If a scanner that worked for months suddenly reports a username or password error, check whether someone reset the account’s password recently.
Can I use an app password with a Google Workspace account?
Usually yes. Google’s own instructions for Workspace printers and scanners use the full Workspace address and an app password on smtp.gmail.com. It depends on the admin: users need permission to turn on 2-Step Verification, and enforcing security keys as the only method turns app passwords off. Many admins prefer the SMTP relay service for office devices instead.
Does Gmail still allow app passwords?
Yes. Google ended plain-password sign-in (the old less secure apps setting), and Google Workspace accounts stopped accepting it on May 1, 2025, the date in Google’s latest announcement. App passwords are still offered to accounts with 2-Step Verification. They aren’t available with Advanced Protection or security-key-only 2-Step Verification, and Google discourages them, so use Sign in with Google or OAuth wherever a device or program offers it.
Should I use port 465 or 587 for Gmail SMTP?
Either works with smtp.gmail.com. Use 587 when the device offers TLS or STARTTLS, and 465 when it only offers SSL. What matters is pairing them correctly, because 587 with SSL selected or 465 with STARTTLS selected usually fails with a timeout or a vague connection error. If one pair fails, try the other before changing passwords.