Gmail SMTP Setup: How to Get an App Password (2026 Step-by-Step Guide)
Free Google account. App Password required. 3 minutes.
TL;DR
- check_circleGmail SMTP server: smtp.gmail.com — port 587 (STARTTLS) or 465 (SSL/TLS).
- check_circleYour normal Google password will NOT work. You must generate an App Password.
- check_circleApp Passwords require 2-Step Verification to be enabled first.
- check_circleFree Gmail caps you at ~500 messages/day. Google Workspace allows ~2,000/day.
- check_circleAuth error 535-5.7.8 almost always means: 2SV is off, password has spaces, or Advanced Protection is on.
Connection settings
smtp.gmail.com587STARTTLSYour full Gmail address (e.g. you@gmail.com)16-character App Password (not your normal Gmail password)What you'll need
A Google account
A regular @gmail.com mailbox, a Google Workspace mailbox, or any account that signs in at accounts.google.com works.
2-Step Verification enabled
Google removed App Passwords for accounts without 2SV in 2024. You must turn it on first — it only takes a minute.
Turn on 2-Step Verificationopen_in_newNot enrolled in Advanced Protection
Google's Advanced Protection Program blocks App Passwords entirely. If you're a journalist, activist, or executive on APP, use OAuth instead — App Passwords aren't an option.
Step-by-step setup
- 1
Open your Google Account security page
Sign in to the Google account you want to send from, then open myaccount.google.com/security. Scroll to the section titled "How you sign in to Google" and look for 2-Step Verification.
Open Google securityopen_in_new - 2
Turn on 2-Step Verification (if it's off)
Click 2-Step Verification, follow the prompts, and confirm with your phone. This unlocks App Passwords — there's no way around it for SMTP.
Enable 2-Step Verificationopen_in_newlightbulbTip: Already on? Skip ahead. You can confirm the green check next to '2-Step Verification: On'.
- 3
Go directly to the App Passwords screen
Open myaccount.google.com/apppasswords. Google may ask you to re-authenticate. This page is unlisted in the main menu — bookmark the URL.
Open App Passwordsopen_in_newwarningWatch out: If the page says "This setting is not available for your account," you're missing 2SV (see step 2) or on Advanced Protection.
- 4
Name the app and generate
Under "App name" type something memorable like CodeOpx Mail. Click Create. Google generates a yellow box with a 16-character lowercase password split into 4 groups of 4 (e.g. abcd efgh ijkl mnop). Copy it now — it's shown only once.
lightbulbTip: If you lose it, just generate another. You can have multiple App Passwords and revoke old ones any time.
- 5
Paste it into your SMTP client
Anywhere that asks for an SMTP password, paste those 16 characters — without the spaces. Gmail accepts the password with or without spaces, but stripping them avoids subtle copy-paste bugs.
- 6
Use these SMTP server settings
Host: smtp.gmail.com · Port: 587 (preferred) or 465 · Encryption: STARTTLS for 587 / SSL for 465 · Username: your full Gmail address (you@gmail.com or you@yourcompany.com on Workspace) · Password: the 16-char App Password.
Connect to CodeOpx Mail
Plug them into CodeOpx Mail in 30 seconds:
- 1Open SMTP configs
Sign in to your free CodeOpx Mail account, then open Dashboard → SMTP. Click "Add config" and choose Gmail / Google Workspace from the provider list — host and port will pre-fill.
- 2Fill in the form
Username: your full Gmail address. Password: paste the 16-char App Password (no spaces). Leave port at 587 and encryption at STARTTLS.
- 3Hit "Test connection"
We open a temporary SMTP session and confirm the server accepts your credentials. Green check = save. Red error = check the troubleshooting table below.
- 4Send your first email
Open Compose, write a message, and pick your new Gmail config from the From dropdown. Done. Logs, opens, clicks, and bounces all show up under Messages.
Common errors & fixes
535-5.7.8Username and Password not accepted
By far the most common Gmail SMTP error. Authentication is failing at Google's edge.
Fix: Check 2-Step Verification is ON. Regenerate the App Password (the previous one may have been revoked). Strip spaces from the password. Make sure the username is the FULL email address, not just the local part.
535-5.7.139Authentication unsuccessful — Workspace specific
Your Workspace admin has blocked less-secure / SMTP-based auth for the org.
Fix: Ask your admin to enable "Less secure app access" for your account, or switch the workflow to OAuth 2.0.
550-5.7.1Daily user sending quota exceeded
You've crossed Google's per-day cap (500 personal / 2,000 Workspace).
Fix: Wait 24 hours from your first send of the day. For higher volume, switch to a transactional provider like SendGrid, Mailgun, or Resend.
454-4.7.0Too many login attempts
Google temporarily rate-limited your IP after several failed auths.
Fix: Wait 15–30 minutes, fix the underlying credential issue, then retry. Don't loop a failing config — that extends the lockout.
421-4.7.0IP not in whitelist for this sender
Hits Workspace org with strict relay rules.
Fix: Admin: add the sending IP to Google Admin Console → Apps → Google Workspace → Gmail → Routing → SMTP relay service.
Sending limits
Gmail's SMTP gateway is rate-limited per user and per 24-hour rolling window. Going over triggers temporary blocks that auto-clear after 24 hours.
| Free Gmail accounts | 500 recipients / day |
| Google Workspace accounts | 2,000 recipients / day |
| Per-message recipients | 100 (To + CC + BCC combined) |
| Burst sending | ~100 messages / hour before throttling kicks in |
| Max message size | 25 MB including attachments |
- lightbulbWarming a new Gmail address? Send a handful of messages the first day, then double daily for a week. Going from 0 to 500 immediately can trip spam heuristics.
- lightbulbWorkspace's 2,000/day cap is per user — if you need more, create additional users or use Google's SMTP Relay Service.
- lightbulbMailing-list traffic over ~200 recipients/day will tank Gmail-user inbox placement fast — use SendGrid, Mailgun, or Resend for newsletters.
FAQ
Can I use my regular Gmail password instead of an App Password?
add
No. Google retired username/password SMTP authentication for anyone with 2-Step Verification on — which is required for App Passwords in the first place. If you're seeing 535-5.7.8 errors, you almost certainly need an App Password.
Do App Passwords expire?
add
They don't expire on a timer, but they're revoked the moment you change your Google password, sign out remotely, or revoke them manually from the App Passwords page. Treat them like API keys — rotate every few months for hygiene.
What's the difference between port 587 and 465?
add
Port 587 uses STARTTLS (encryption is negotiated after the initial connection). Port 465 uses implicit SSL/TLS (encrypted from the first byte). Functionally identical for sending. We default to 587 because more corporate firewalls allow it.
Can I send from a different From address than my Gmail?
add
Yes, but only if you've added it under Gmail → Settings → Accounts and Import → "Send mail as." Workspace aliases work the same way. Trying to spoof an unverified From address gets messages rewritten back to your real Gmail address or rejected entirely.
Will my replies come back to CodeOpx Mail?
add
Replies go to whatever Reply-To header you set (or the From address if none). To read them inside CodeOpx, configure IMAP separately — or just let them flow back to Gmail and read them there.
Does sending through Gmail SMTP affect my Gmail reputation?
add
Yes — every send via your account counts toward your Gmail user-level reputation. Hard bounces, complaints, and spam markings affect future deliverability on the same account. Use a dedicated address for marketing if you care.
Is Gmail SMTP enough for transactional emails (password resets, receipts)?
add
For low volume (<100/day), yes. Past that you'll want SendGrid, Mailgun, Resend, Postmark, or Amazon SES — designed specifically for transactional traffic with much higher caps and better deliverability metrics.
Video tutorial
Watch: Gmail SMTP App Password tutorials on YouTube
We curated a YouTube search of recent walkthroughs by independent creators. The official docs (linked below) remain the source of truth.
play_arrowWatch on YouTubeFurther reading
Related provider guides
Ready to send through gmail?
Sign up for CodeOpx Mail, add this SMTP config, and you'll be sending tracked emails in under 5 minutes.