Where to Find an Application-Specific Password for Gmail
If you've ever tried to connect an older email client, a third-party app, or a mail server to your Gmail account and hit a wall — even after entering the right password — an application-specific password is likely what you're missing.
What Is an Application-Specific Password?
An application-specific password (ASP) is a randomly generated 16-character code that Google creates on your behalf. It lets a specific app or device access your Gmail account without using your real Google account password.
This matters because Google's standard sign-in process uses OAuth 2.0 — a modern authentication protocol that apps open in a browser window, where you log in directly through Google's interface. But many older apps, mail clients, and server-side tools don't support OAuth. They use a simpler method called basic authentication, which just sends a username and password directly. Google blocks this by default for security reasons — unless you provide an app-specific password.
Think of it as a temporary, scoped key that only works for one app and can be revoked independently without changing your main password.
The One Requirement: 2-Step Verification Must Be Active
You cannot generate an application-specific password unless 2-Step Verification (2SV) is turned on for your Google account. This is a hard requirement — not a suggestion.
If 2-Step Verification is off, the option to create app passwords simply won't appear. Google designed it this way deliberately: app passwords bypass the normal sign-in flow, so they require a baseline of account security before they're available.
If you haven't set up 2-Step Verification yet, you'll need to do that first at myaccount.google.com/security.
🔑 Where to Find the App Passwords Page
Once 2-Step Verification is active, here's how to reach the app passwords section:
- Go to myaccount.google.com
- Click Security in the left-hand navigation
- Under the "How you sign in to Google" section, look for 2-Step Verification and click it
- Scroll to the bottom of that page — you'll see an App passwords option
- Click it, sign in again if prompted, and you'll land on the app password generator
Alternatively, you can navigate directly to: myaccount.google.com/apppasswords
That URL takes you straight there if your account already has 2-Step Verification enabled.
What the Generator Looks Like
You'll see a text field (in some account versions, a dropdown) where you name the app or device you're setting up — for example, "Outlook desktop" or "Home NAS backup." You don't have to use a specific name format; it's just a label for your own reference.
Click Create, and Google generates a 16-character password displayed in a yellow box. Copy it immediately — Google will not show it again after you close or navigate away from that screen.
Where App Passwords Are Used
| Common Use Case | Why ASP Is Needed |
|---|---|
| Older desktop email clients (e.g., Thunderbird, older Outlook) | Don't support OAuth 2.0 |
| IMAP/SMTP server configuration | Requires direct credential input |
| Mobile apps using basic auth | Can't redirect to Google's sign-in page |
| Backup and sync tools | Automated processes can't complete browser-based login |
| Smart home devices with email features | No browser interface for OAuth flow |
Managing and Revoking App Passwords
Every password you generate appears as a named entry on the App Passwords page. You can revoke any one of them individually at any time without affecting your main account password or other app connections.
This is one of the practical advantages of using ASPs — if a device is lost, stolen, or decommissioned, you revoke just that key. Your other connected apps continue working uninterrupted.
There's no limit mentioned by Google on how many you can generate, but keeping the list tidy makes it easier to audit what has access to your account.
⚠️ When the Option Doesn't Appear
A few situations can hide or disable the app passwords option even with 2-Step Verification on:
- Google Workspace (business/school accounts): Your organization's administrator controls whether app passwords are allowed. If the option is missing, the admin has disabled it.
- Advanced Protection Program: If your account is enrolled in Google's Advanced Protection, app passwords are blocked entirely as part of its stricter security posture.
- New account setups: Occasionally there's a short delay after enabling 2SV before the option becomes available.
The Variables That Determine Your Setup
Whether an app password is the right tool — and how you use it — depends on several factors that vary by situation:
- Which app or client you're connecting — modern apps that support OAuth don't need ASPs at all
- Whether you're on a personal Google account or a Workspace account — admin policies may restrict or eliminate the option
- Your security posture — ASPs are useful, but they are credentials that should be stored carefully, not shared or embedded in plaintext config files without protection
- Your operating system and email client version — some updated clients have added OAuth support that removes the need for ASPs entirely
A developer setting up automated email through Gmail's SMTP relay has different considerations than someone trying to add their Gmail to a legacy desktop client. Both might reach for an app password, but what they do with it — and how carefully they need to manage it — differs considerably.
How carefully that tradeoff plays out depends entirely on your own setup. 🔐