Generate an App Password to use Gmail via IMAP/SMTP

When developing an application that needs to send or receive emails, a fairly natural idea is to use a Gmail address directly for testing.

For a long time, it was enough to use your email address and password. But today, this method no longer works.

Google now blocks access to Gmail accounts from most applications that simply use a regular password.

Fortunately, Google offers a solution: App Passwords.

What is an App Password?

An App Password is a password generated by Google specifically for an application.

Unlike your main password:

• it is limited to a specific use
• it can be revoked at any time
• it does not grant full access to your Google account

The idea is to allow an application to connect to Gmail without giving it your actual password.

Generating an App Password

Enable two-factor authentication

Before you can create an App Password, you need to enable two-step verification on your Google account.

Go to your Google account's security settings and enable two-factor authentication.

Without this step, the App Passwords menu will not appear.

Create a password

Once two-factor authentication is enabled:

• open the Google security settings
• look for the "App passwords" section
• create a new password
• choose a name like "SMTP Server" or "NodeJS Application"

You can also click on the direct link: https://myaccount.google.com/apppasswords

Google will then generate a string that looks like this:

abcd efgh ijkl mnop

This is the password you'll need to use in your application.

Using your App Password

SMTP configuration

To send emails with Gmail, use the following settings:

SMTP Server: smtp.gmail.com
Port: 587
Security: TLS / STARTTLS
Username: <your-address@gmail.com>
Password: <your_app_password>

IMAP configuration

If you want to receive or read emails, you'll need to use IMAP.

The settings are as follows:

IMAP Server: imap.gmail.com
Port: 993
Security: SSL/TLS
Username: your-address@gmail.com
Password: <your_app_password>

Gmail's limitations

Even though Gmail works very well for testing or small projects, it doesn't replace a genuine transactional email service.

In particular, Google enforces:

• daily sending limits
• anti-spam checks
• restrictions on certain automated uses

For a professional project or a high-volume application, solutions like Brevo (French), Resend, Mailgun, or SendGrid will generally be better suited.