What an app password is and why Gmail requires it
An app password is a 16-character code that Gmail generates for you to use instead of your regular password when you sign into apps or devices that don't support Google's standard security checks. Gmail created app passwords to protect your account: if a third-party app stores your real password and that app gets hacked, your Gmail account stays find because the attacker only has the limited app password, not your actual login.
You only need an app password if you're signing into Gmail through an app that isn't Google's own Gmail app — things like Outlook, Apple Mail, Thunderbird, or older email clients. If you use Gmail's official app or Gmail in a web browser, you don't need one. Gmail will tell you when you need it: the app will reject your regular password and ask for an app password instead.
App passwords only work if you have two-factor authentication turned on for your Google account. Two-factor authentication means Google sends you a code on your phone when you sign in from a new device, adding a second security layer. Without it enabled, Gmail won't let you create an app password.
Key Takeaways
- App passwords are 16-character codes you create in your Google Account settings, not something you request from Gmail support.
- You need two-factor authentication enabled on your Google account before you can create an app password.
- Each app or device you use gets its own app password — you don't reuse the same one across multiple programs.
- You can delete an app password at any time from your Google Account settings if you stop using that app or device.
How to turn on two-factor authentication first
Go to myaccount.google.com in your web browser and sign in with your Gmail address and password. On the left side, click Security. Scroll down until you see How you sign in to Google and look for 2-Step Verification.
Click on 2-Step Verification. Google will ask you to confirm your password again, then walk you through adding a phone number. Google will send a code to that phone number or your authenticator app (like Google Authenticator or Authy) each time you sign in from a new device. Once you've completed the setup, you'll see a green checkmark next to "2-Step Verification is on."
If you already have two-factor authentication enabled, skip this step and move to the next section.
Where to create your app password in Google Account settings
Go back to myaccount.google.com and click Security on the left. Scroll down to How you sign in to Google again. Below 2-Step Verification, you should now see App passwords — this option only appears if two-factor authentication is on.
Click App passwords. Google will ask you to sign in again and may ask for your two-factor code. After you verify, you'll see a dropdown menu asking you to select the app and device you're setting up. For example, if you're adding Gmail to Outlook on your Windows computer, you'd select Mail from the first dropdown and Windows from the second.
If your specific app or device isn't listed in the dropdowns, choose the closest match — Mail works for most email clients, and Windows, Mac, or Linux covers most computers. For phones, pick iPhone or Android.
What Google generates and how to use it
After you select your app and device, Google generates a 16-character password with spaces in it — it looks something like abcd efgh ijkl mnop. Google displays this password once. Copy the entire code, including the spaces, or write it down when ready. You won't be able to see it again.
Go to the app or device you're setting up — Outlook, Apple Mail, Thunderbird, or whatever you're using — and sign in. When it asks for your password, paste or type the 16-character app password instead of your regular Gmail password. The app will accept it and stay signed in.
You don't need to remember the app password. Once the app accepts it, the app stores it and uses it automatically each time it checks your email. You only type it in once during setup.
Managing and deleting app passwords you no longer use
Go to myaccount.google.com, click Security, and scroll to App passwords. You'll see a list of every app password you've created, labeled by the app and device — for example, "Mail on Windows" or "Outlook on iPhone." Each one shows when you created it.
If you stop using an app or device, click the app password in the list and select Delete. This removes that password when ready, and the app will no longer be able to sign in to your Gmail. You can create a new app password for the same app on a different device — each device gets its own code.
Deleting an old app password doesn't affect your other app passwords or your regular Gmail password. It only stops that specific app from accessing your account.
What to do if you forget the app password
If you didn't write down the app password and you've closed the window where Google showed it, you can't recover it — Google doesn't store it where you can view it again. Instead, go back to myaccount.google.com, click Security, find the app password in your list, and delete it. Then create a new one by following the steps above. Google will generate a new 16-character code for that app.
The app will stop working until you give it the new password. Go back into the app's settings (usually under Mail Settings, Account Settings, or Preferences) and update the password field with the new 16-character code.
Common reasons app passwords don't work
The most common reason an app password fails is that two-factor authentication isn't actually enabled on your account. Go back to myaccount.google.com and check Security — if you don't see App passwords as an option, two-factor authentication is off. Turn it on first, then create your app password.
Another reason is typing the password wrong. The 16-character code includes spaces, and some apps are picky about whether you include them. Try copying and pasting the code instead of typing it by hand. If the app still rejects it, delete the app password and create a new one.
If you're using Gmail's official Gmail app or signing in through a web browser, you don't need an app password at all — use your regular Gmail password. App passwords are only for third-party apps like Outlook, Apple Mail, or Thunderbird.
Frequently Asked Questions
Do I need a different app password for each device?
Yes. If you use Outlook on both your Windows computer and your iPhone, you create two separate app passwords — one for each device. This way, if one device is lost or stolen, you can delete just that device's password without affecting the other one.
Can I use the same app password on multiple devices?
Technically you can, but Google recommends against it. If you create one app password and use it on five different devices, and one of those devices is stolen, you'd have to delete the password and create new ones for all five devices. It's easier to give each device its own code from the start.
What happens if I delete an app password?
The app stops being able to sign in to your Gmail. You'll see an error message the next time the app tries to check your email. You can create a new app password for that app and update the password in the app's settings, or you can stop using that app entirely.
Is an app password the same as my Gmail password?
No. Your Gmail password is what you use to sign into Gmail.com or the Gmail app. An app password is a separate 16-character code you create only for third-party apps. Changing one doesn't affect the other.
Can someone use my app password to access my Gmail account?
They can only use it to sign into the specific app or device it was created for. If someone gets your app password for Outlook, they can't use it to sign into Gmail.com or the Gmail app — they'd need your actual Gmail password for that. This is why app passwords are safer than sharing your real password with apps.