App Password Gmail Guide: Where It Moved, Why It's Hidden
The app password gmail flow is the survivor of Google's long war on password logins: the one sanctioned way left to give older software - SMTP senders, IMAP clients, scanners, scripts - a credential that works where OAuth cannot reach. Google has moved the page, buried the menu entry, and quietly removed it for whole categories of accounts, which is why half the questions about app passwords are really the question "where did it go?"
Here is the current geography: how to create one, every account state that hides the page, and the operational habits that keep a 16-character secret from becoming an incident.
What an app password actually is
An app password is a 16-character code that substitutes for your Google password in one narrow context: legacy sign-in protocols like SMTP and IMAP. It does not bypass 2-Step Verification so much as embody it - Google's position is that once you have 2FA, a static per-app secret is an acceptable side door because it can be individually revoked and never grants web-session access.
Three properties matter operationally. It is shown once at creation, never again. It grants full mail-protocol access - anyone holding it can read and send as you until revoked. And Google invalidates existing app passwords on certain account events (notably password changes), which is the root cause of a whole genre of "it worked yesterday" failures.
Creating an app password gmail accepts, step by step
The menu location has shifted between Security-page redesigns, so skip the menu entirely:
- Enable 2-Step Verification first (Google Account, Security). Without it, the app-passwords page does not exist - not hidden, absent.
- Go directly to myaccount.google.com/apppasswords, or type "app passwords" into the search box at the top of your Google Account page. Both beat spelunking the menus.
- Name the password for the software that will hold it - "billing tool SMTP", "office scanner" - because six months from now the revocation decision depends on recognizing the name.
- Copy the 16 characters immediately. Spaces are display formatting; with or without, servers accept it.
- Paste it as the password in the app's settings, with your full email address as the username.
If that direct URL bounces you back to Security with no page, your account is in one of the refusal states below.
Every state that hides or refuses the page
- No 2-Step Verification. The page requires it, full stop. Enroll first.
- Workspace policy. Admins can disable app passwords domain-wide (Admin console, Security, Authentication). The user-side symptom is the page simply never appearing; the fix is administrative.
- Advanced Protection Program. Enrolled accounts trade app passwords away deliberately - the program exists to close exactly this class of door. No workaround by design.
- Passkey-only accounts that skipped a password. Accounts configured to sign in without any password at all can lack the password-derived machinery; adding a password back to the account generally restores eligibility.
- Some managed education and child accounts, where the policy surface differs and the page may be withheld regardless of 2FA state.
Each state's page absence looks identical; the cause list is what turns a mystery into a two-minute check.
When the password exists but stops working
A working app password fails later for a shortlist of reasons, in rough order of frequency: the account password changed (all app passwords are revoked automatically); a security checkup or admin sweep revoked it; the app is sending it to the wrong host or with a truncated paste; or the account picked up a new restriction (2FA method changes, enrollment in stricter programs). The symptom is always the same 535-class authentication failure, indistinguishable from a typo - so the recovery is mechanical: generate a fresh one, update the single app it belongs to, revoke the old one if it still shows.
That "single app" phrasing is the discipline worth adopting. One app password per integration, named for it, revoked with it. Sharing one code across five tools converts every rotation into a five-system outage and every leak into a five-system investigation.
The security ledger, honestly kept
An app password is a static secret with mail-wide power, and its risk profile is exactly that of any long-lived credential. Sane handling for a small team: store it in a secrets manager or password vault, never in a repo, a doc, or a chat thread; prefer OAuth-capable software when a real choice exists; audit the app-passwords list quarterly and revoke anything unnameable; and treat "the tool only accepts app passwords" as mild but real technical debt with security's clock ticking on it. The quarterly audit takes five minutes, and it is the single habit that catches both forgotten integrations and credentials that outlived the tools holding them.
For machine sending specifically, remember the alternative geometries before minting another one. Workspace's SMTP relay can authenticate by registered IP - zero stored secrets on the appliance. Dedicated sending platforms issue scoped API keys that cannot read your inbox, which is a strictly better blast radius than any mailbox credential. The app password is the right tool when the identity really must be a person's mailbox; it is the habit-shaped tool the rest of the time.
App passwords keep working, year after year, precisely because Google fenced them behind 2FA and revocability. Learn the one URL, keep the naming discipline, and this is the most boring credential you own - which is the highest compliment infrastructure gets.
Frequently asked questions
Where do I find app passwords in my Google account?
Go directly to myaccount.google.com/apppasswords, or search "app passwords" in the Google Account search bar. The page only exists after 2-Step Verification is enabled, and menu paths change often enough that the direct URL is the reliable route.
Why is there no app passwords option in my Google account?
One of five states: 2-Step Verification is off, a Workspace admin disabled app passwords, the account is in Advanced Protection, it is a passkey-only account without a password, or it is a managed account type that withholds the page. Fix the state and the page appears.
Why did my Gmail app password suddenly stop working?
Changing your Google account password automatically revokes every app password, and security checkups or admin sweeps can do the same. Generate a new one and update the app - the old code is gone permanently, not misbehaving.
Are Gmail app passwords safe to use?
They are acceptable when handled like the credentials they are: one per integration, stored in a vault, revoked when the tool retires. They grant full mail access, so prefer OAuth where software supports it and scoped API keys on sending platforms for application email.