GuidesMail providers

Gmail app passwords: why the option is missing and how to get it back

Google offers app passwords only when 2-Step Verification is on, and withholds them completely on some accounts. Here is how to find out which case is yours and what to change, checked against Google's help pages in October 2026.

Updated 5 October 20269 min read

In short

App passwords only exist on Google accounts that have 2-Step Verification turned on.
Open myaccount.google.com/apppasswords directly. Google's help no longer describes a path through the menus.
On Google Workspace the admin has to allow 2-Step Verification for users and must not enforce security keys as the only method.
App passwords still work on Google Workspace in 2026. What ended in spring 2025 was sign-in with the normal account password.
An account enrolled in Advanced Protection cannot use app passwords at all.

If the app passwords page will not open for your Google account, one of four things is true: 2-Step Verification is off, your only second step is a security key, the account belongs to an organization whose admin has not allowed it, or the account is enrolled in Advanced Protection. The first two you can change yourself in a few minutes; the third needs the Google Workspace admin, which in a small company is often you. The fourth cannot be changed without leaving Advanced Protection.

The menu names and quotes below were checked against Google's help pages on October 5, 2026. Google renames these menus from time to time, so rely on the direct links more than on the labels.

What you see when the option is missing

Google's own help page, Sign in with app passwords, no longer describes a path through the account menus. It gives one link, myaccount.google.com/apppasswords, and says you may need to sign in again. So open that address directly instead of looking for an entry in the security settings.

When the account is not eligible, the page does not open. People who run into this report a short notice, “The setting you are looking for is not available for your account”, for example in this public bug report from 2020. Google's help does not quote the notice. It only lists reasons:

If you've set up 2-Step Verification but can't find the option to add an app password, it might be because:

Your Google Account has 2-Step Verification set up only for security keys.

You're logged into a work, school, or another organization account.

Your Google Account has Advanced Protection.

One line above that list, the same page names the condition that comes before all three: “To create an app password, you need 2-Step Verification on your Google Account.” That makes four cases. The help page stops there and does not say what to do about any of them.

Find your case

Case	How to recognize it	Who can change it	What to do
2-Step Verification is off	Your Google Account offers “Turn on 2-Step Verification” under “How you sign in to Google”	You	Turn it on, then open the app passwords link again
A security key is the only second step	2-Step Verification is on, and a hardware key is the only method set up	You	Add another second step next to the key
Work, school or organization account	You sign in to Google with an address on your own or your employer's domain	The Google Workspace admin	Allow 2-Step Verification for users, and do not limit it to security keys
Advanced Protection	You enrolled the account in Google's Advanced Protection Program	Nobody, while enrolled	Use a tool that signs in with Google, or another mailbox

One thing to rule out before you start: if several Google accounts are signed in to the same browser, check which account the page is showing. It is easy to test the link with a private account while the mailbox you want to connect is the work one.

Case 1: 2-Step Verification is off

2-Step Verification means that Google asks for a second proof after the password, such as a tap on your phone. App passwords only exist on accounts that have it turned on. Google's steps, as of October 2026:

Open your Google Account.
Go to Security & sign-in.
Under “How you sign in to Google”, select Turn on 2-Step Verification.
Follow the steps on screen. Google recommends prompts on your phone as the second step. An authenticator app or a code by text message also count.
Open myaccount.google.com/apppasswords again.

The steps come from Google's page Turn on 2-Step Verification. The same page warns that for an account you use through work or school “these steps might not work”. If that is your situation, go to case 3.

Case 2: a security key is your only second step

A security key is a small USB or NFC device that you plug in or tap to confirm a sign-in. If it is the only second step on the account, Google withholds app passwords. The reason lies in what an app password does: it lets a program in with a password alone, and a key-only setup exists to prevent exactly that.

Google names this reason but not the remedy. Its wording, “set up only for security keys”, points to one: add a second method beside the key, such as Google prompts or an authenticator app, and then open the app passwords link again. Keep the key. You are adding a method, not replacing one.

Case 3: a Google Workspace account

Google's list says app passwords may be missing when “you're logged into a work, school, or another organization account”. The sentence is easy to misread. It does not say that organization accounts cannot have app passwords. It says that the organization's admin decides.

Do app passwords still work on Google Workspace in 2026?

Yes. Some guides say that Google removed them for Workspace in spring 2025. What Google ended then was sign-in with the normal account password, which it calls “less secure apps”. Its admin help says so in Transition from less secure apps to OAuth:

You will no longer use a password for access (with the exception of app passwords).

Google's pages do not agree on the date of that change. This one names March 14, 2025. The admin page on POP and IMAP access names May 1, 2025. Both describe the end of the plain password, not of app passwords. A third admin page, How 2-Step Verification works with legacy apps, calls app passwords “discouraged” and confirms in the same paragraph that “your users can also use legacy apps by signing in using an app password”. And Google's current instructions for sending mail from a device or app through smtp.gmail.com tell admins to enter the complete Google Workspace address “and an app password”.

What the admin has to set

The settings that decide whether a user can reach app passwords sit on one page of the Google Admin console. Google documents them in Deploy 2-Step Verification. You must be signed in as a super administrator.

In the Admin console, go to Menu → Security → Authentication → 2-step verification.
To change the setting for some users only, select their organizational unit at the side.
Check the box Allow users to turn on 2-Step Verification.
Look at Enforcement. If it is off, users may pick any method and nothing else needs changing.
If enforcement is on, look at Methods. “Any” and “Any except verification codes via text, phone call” leave app passwords available. “Only security key” does not.
Save.

The fifth step is the one that gets overlooked. Google's admin help is explicit about it:

Enforcing security keys disables app passwords—You can't require users to use a security key for 2SV and also let them use app passwords to sign in to legacy apps.

According to the same documentation, “Only security key” has covered passkeys as well since passkeys were added. An organization that enforces it has therefore switched off app passwords for those users, whichever of the two they carry.

Once the admin has saved, the user turns on 2-Step Verification as in case 1 and opens the app passwords link.

If you are not the admin

Send the person who manages your Google Workspace something they can act on without a call:

Could you check this page in the Google Admin console for my account
(name@example.com)?

Menu → Security → Authentication → 2-step verification

1. "Allow users to turn on 2-Step Verification" should be checked.
2. If enforcement is on, "Methods" should not be "Only security key".

I need an app password to connect my mailbox to a mail tool
over IMAP and SMTP.

If the answer is that your organization enforces security keys on purpose, that is a security decision and not a misconfiguration. App passwords will stay off for that account.

Case 4: Advanced Protection

The Advanced Protection Program is Google's strictest account setting. It requires a passkey or security key at sign-in and limits which outside apps may touch your data. It also rules out app passwords. Under the question “Can I still use app passwords?”, Google's page on the program answers:

No. Apps that use app passwords instead of 2-Step Verification are blocked for users with Advanced Protection. When you enroll in Advanced Protection, any current app passwords are revoked.

There is no setting that works around this. A tool that signs in with Google and has been verified by Google can still be used with such an account. A tool that asks for an app password cannot, and that includes WarmupBay.

Once the page opens: creating the app password

An app password is a separate passcode of 16 characters that Google generates for one program. The program uses it in place of your normal password, so you never hand that one over.

Open myaccount.google.com/apppasswords. Google may ask you to sign in again.
Give the password a name that will tell you later what it was for, such as the name of the tool.
Create it and copy the 16 characters straight away. Google's help says that every app password “can only be checked once”.
Paste it into the tool, together with the full email address of the account.

If you lose the characters, there is nothing to recover. Create a new app password and remove the old one.

What an app password lets in, and how to take it back

Google is candid about the trade-off. Its help page opens with the warning that app passwords “aren't recommended and are unnecessary in most cases”, and the admin help gives the reason: “app passwords bypass 2SV”. Whoever holds the 16 characters can reach the mailbox over IMAP and SMTP without the second step. Three habits keep that risk small:

One app password per tool. Never reuse one, and name each after the tool it belongs to.
Remove it when you stop using the tool. On the app passwords page, find the entry and remove it. In Google's words, once you revoke it, “the app can't access your Google Account again”.
Only give it to a tool you would also trust with the mailbox. An app password is not limited to one folder or one kind of message.

A berth for the mailbox: connecting to WarmupBay

WarmupBay is a free email warmup service. Connected mailboxes send each other a few short emails a day, reply to some of them, and move warmup emails that landed in spam into a folder named “WarmupBay”. It connects Gmail and Google Workspace mailboxes with an app password, which is why this guide exists. Other providers connect over IMAP and SMTP, with the details you would enter in a mail program.

Two limits, stated plainly. Microsoft 365 and Outlook.com mailboxes cannot be connected yet. And a Google account without access to app passwords, as in case 4 or under enforced security keys, cannot be connected either, because there is no app password to enter.

If your account is in case 1, 2 or 3, the rest is short. You create a free account, enter the address and the app password, and WarmupBay checks the SPF, DKIM and DMARC records of your domain, the three DNS entries that tell receiving servers which mail really comes from you. Warmup starts with 3 emails a day and adds one a day up to 10, which is the free limit. The feature list has the rest.

If Google rejects the app password you have just created, the causes are different ones. They are covered in Gmail app password not working.

Questions people ask

I use Gmail with my own domain. Is that a personal account or a Google Workspace account?

If you sign in to Google with the address on your own domain, it is a Google Workspace account, even when you are the only user. In that case you are usually the super administrator as well and can change the settings in the Admin console yourself. If you sign in with an @gmail.com address and only send as your domain address, it is a personal account and cases 1, 2 and 4 apply.

What happens to my app passwords when I change my Google password?

Google revokes all of them. Its help page says this is done to protect the account. Every tool that used an app password stops working until you create a new one and enter it there.

Do I have to switch on IMAP in Gmail before I connect a tool?

Not on a personal Gmail account. Google removed the IMAP switch in January 2025 and IMAP is always on. On Google Workspace the admin decides in the Admin console whether IMAP is available, and whether it is limited to certain mail programs.

Do Outlook.com and Microsoft 365 have app passwords that work the same way?

No. Microsoft has required modern authentication, also called OAuth, for Outlook.com mailboxes since September 16, 2024, and it removed password sign-in for IMAP and POP in Exchange Online. Its documentation says that this also prevents the use of app passwords. WarmupBay cannot connect Microsoft mailboxes yet.

Will I have to confirm every sign-in on my phone once 2-Step Verification is on?

Not necessarily. Google lets you sign in with your password and a second step, or with a passkey, which needs no second step. On Google Workspace the admin can also allow users to mark a device as trusted, so that the second step is not asked for again on that device.