Quick answer: Sign in at myaccount.google.com/apppasswords (2-Step Verification must be on), create a 16-character app password, and paste it into the old mail app where it asks for your Gmail password—not into the normal web login.
App passwords confuse almost everyone the first time Outlook desktop, Thunderbird, or a scanner asks for a “Gmail password” and the normal one fails. Here is what they are, when you need one, and when you should not use them.
What is a Gmail app password?
It is a one-time 16-character code Google generates so a legacy app can access your account without storing your real password. Modern Google sign-in (browser, official Gmail app) does not need an app password.
When you actually need one
- Older desktop mail clients that do not support modern OAuth sign-in
- Some printers/scanners that send email through Gmail SMTP
- Certain automation tools that only accept a password field
If the official Gmail app or mail.google.com works, skip app passwords and use normal Gmail login with 2-step verification.
How to create a Gmail app password
- Turn on 2-Step Verification first (required).
- Visit myaccount.google.com/apppasswords while signed in.
- Name the app (for example “Office PC Thunderbird”).
- Click Create, copy the 16-character password (spaces do not matter).
- Paste it into the mail app’s password field and save.
- Store a note in your password manager that this device uses an app password—you will not see the code again.
Security tips
- Create a separate app password per device so you can revoke one without breaking others.
- If a laptop is stolen, revoke its app password under the same Google page.
- Never type an app password into a website that looks like Gmail login—that is almost certainly phishing.
FAQs
Why can’t I find App Passwords?
2-Step Verification is off, your account type blocks them (some Workspace admins), or Google is pushing you to use “Sign in with Google” instead.
Does an app password bypass 2FA?
It is a controlled exception for that app only. Your web login should still challenge 2FA.
Can I use one app password for everything?
Technically yes—but revoke-and-replace becomes painful. Prefer one per device.
Not affiliated with Google. Official documentation lives in Google Account Help.
Author: Rabi Mehar · Updated: August 2026