Google Workspace no longer accepts a plain username and password from mail apps. If Outlook, Thunderbird, a phone or a scanner keeps asking for your password or reports "incorrect password" even though it is right, this is almost always why. This guide explains the two methods that work now, OAuth 2.0 sign-in and app passwords, and how to set up each one.
It does not apply to Domain India Business Email, which is a separate product with its own settings. See Business Email vs the email included with your hosting.
Google has turned off "less secure app" access for Workspace accounts, so mail apps must sign in with OAuth 2.0 (the app opens a Google sign-in window) or, for older apps and devices that cannot do that, an app password. Use OAuth wherever the app supports it. App passwords work only when 2-Step Verification is on, and you create them at myaccount.google.com/apppasswords. Devices such as scanners are often better served by Google's SMTP relay, set up by your Workspace admin.
1. What changed in Google Workspace sign-in
For years, mail apps could connect to Gmail over IMAP, POP and SMTP with just your email address and password. Google called these "less secure apps", because a stolen password was all an attacker needed.
Google phased this out for Workspace accounts, and the final step took effect in 2025. Today:
- Password-only sign-in from mail, calendar (CalDAV) and contacts (CardDAV) apps is refused.
- OAuth 2.0 ("Sign in with Google") is the standard method.
- App passwords remain as a fallback for apps that cannot do OAuth, and only for accounts with 2-Step Verification.
- The old "Less secure app access" setting no longer exists, for users or admins.
2. OAuth 2.0 or app password: which to use
| Question | OAuth 2.0 | App password |
|---|---|---|
| How you sign in | A Google sign-in window opens; you approve access | You paste a 16-character code instead of your password |
| Needs 2-Step Verification | No (but strongly recommended) | Yes, always |
| Works with | Current Outlook, Apple Mail, iPhone and iPad Mail, Thunderbird, Gmail app | Older apps, some devices and scripts that ask only for a password |
| Password stored in the app | No, a revocable token | Yes, the app password |
| Changing your Google password | Mail apps may ask you to sign in again | Google revokes your app passwords |
| Recommended | Yes, first choice | Only when OAuth is not available |
3. Set up a mail app with OAuth 2.0
In current apps, OAuth is automatic when you choose the right account type.
- Add a new accountin your mail app.
- Choose "Google"(Apple Mail, iPhone, iPad) or just enter your Workspace address (Outlook, Thunderbird). The app detects Google and opens a sign-in window.
- Sign in with your normal Google passwordand complete 2-Step Verification if it is on.
- Approve the accessthe app asks for, such as mail, contacts and calendar.
- Finish.The app stores a token, not your password. You can remove its access at any time in your Google Account under Security.
If you add the account manually in Thunderbird, choose OAuth2 as the authentication method, not "Normal password". The server settings are:
| Service | Server | Port | Security |
|---|---|---|---|
| IMAP (incoming) | imap.gmail.com | 993 | SSL/TLS |
| POP (incoming) | pop.gmail.com | 995 | SSL/TLS |
| SMTP (outgoing) | smtp.gmail.com | 465 or 587 | SSL/TLS on 465, STARTTLS on 587 |
If the app never opens a Google window and only offers a password box, it is too old for OAuth. Update it, or use an app password.
4. Create and use an app password
An app password is a 16-character code that lets one app sign in without OAuth. It gives full access to your mailbox, so treat it like a password.
- Turn on 2-Step Verification.Go to myaccount.google.com, open Security, and set up 2-Step Verification if it is off.
- Open the App passwords pagedirectly at myaccount.google.com/apppasswords. It is not always shown in the Security menu, so use the address or search "App passwords" in your Google Account.
- Type a namefor the app, such as "Office scanner" or "Outlook 2016 on reception PC", and click Create.
- Copy the 16-character codeshown. Google shows it only once.
- Paste it into the app's password fieldin place of your Google password. Use your full Workspace email address as the username.
Google does not offer app passwords when 2-Step Verification is off, when your account uses only security keys for 2-Step Verification, or when Advanced Protection is on. In a Workspace organisation, your admin's security settings can also affect it. Ask your Workspace admin.
Remove app passwords you no longer use from the same page. Google also revokes them all when you change your account password, so you then need new ones.
5. What the Workspace admin needs to check
If users in your organisation cannot connect even with OAuth, an administrator should check these in the Google Admin console (admin.google.com). Menu names can move as Google updates the console.
- IMAP and POP access: Apps › Google Workspace › Gmail › End User Access. Turn on IMAP and, if you use it, POP for the right organisational unit. You can also restrict IMAP to OAuth mail clients only.
- Third-party app access: Security › Access and data control › API controls. If your organisation restricts unconfigured apps, the mail apps your staff use (for example Outlook or Thunderbird) must be allowed there.
- 2-Step Verification: Security › Authentication › 2-Step Verification. Allow it for everyone, and enforce it if you can.
- Sign-in events: Reporting › Audit and investigation › Login log events, to see failed sign-ins and the method used.
6. Scanners, printers and website forms that send email
Many multifunction printers, CCTV systems and older scripts only support a username and password for SMTP.
For a website on Domain India hosting, see PHP sendmail settings.
7. Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
| "Incorrect password" with the right password | The app is using password-only sign-in | Remove the account and add it again with OAuth, or use an app password |
| No Google sign-in window appears | App version too old for OAuth | Update the app, or use an app password |
| App passwords page not available | 2-Step Verification off, security keys only, or Advanced Protection | Turn on 2-Step Verification with a phone or app method, or ask your admin |
| Worked for months, then stopped | Google password changed, so app passwords were revoked | Create a new app password |
| "IMAP access disabled" or similar | IMAP turned off for your organisational unit | Workspace admin turns on IMAP in End User Access |
| Sending from a device fails | Device cannot do OAuth | Use an app password or the SMTP relay service |
For all Workspace server names and ports in one place, see Google Workspace email settings: ports, servers and SSL.
8. Good security habits
- Use OAuth whenever the app supports it, and keep app passwords for the few devices that need them.
- Give each device its own app password, named clearly, so you can revoke one without breaking the rest.
- Turn on 2-Step Verification for every user; as an admin, enforce it.
- Review connected apps and app passwords every few months and remove old ones.
- Never put your main Google password in a script, a website config file or a shared device.
9. Email options at Domain India
If you want mailboxes on your own domain from Domain India itself, Business Email costs ₹60 per mailbox per month (Domain India list price on 19 September 2026, excluding 18% GST). It includes webmail with calendar and contacts, IMAP and SMTP over TLS for Outlook, Apple Mail, Thunderbird and phones, and two-factor authentication. Email accounts are also included with our shared hosting plans.
- Priced per mailbox - start with one
- Email at your own domain ([email protected])
- Add and remove mailboxes yourself
- Webmail with calendar, contacts and tasks
Why does Google Workspace say my password is incorrect in Outlook or Thunderbird?
Google Workspace no longer accepts password-only sign-in from mail apps. The app must use OAuth 2.0 (a Google sign-in window) or, if it cannot, an app password created at myaccount.google.com/apppasswords.
Do I need 2-Step Verification to use an app password?
Yes. App passwords are only available when 2-Step Verification is turned on. They are not offered if the account uses only security keys for 2-Step Verification or has Advanced Protection turned on.
How long is a Google app password?
It is 16 characters. Google shows it once when you create it. You enter it in the app's password field instead of your normal Google password.
Do app passwords stop working when I change my Google password?
Yes. Google revokes your app passwords when you change your account password, so you need to create new ones for each app or device.
What are the IMAP and SMTP settings for Google Workspace?
Incoming IMAP is imap.gmail.com on port 993 with SSL/TLS. Outgoing SMTP is smtp.gmail.com on port 465 with SSL/TLS or port 587 with STARTTLS. Use OAuth 2.0 or an app password to sign in.
How do I send email from a scanner or printer through Google Workspace?
Either give the device an app password for smtp.gmail.com, or have your Workspace admin set up Google's SMTP relay service, which can accept mail from your office's IP address without storing a password on the device.
Does this guide apply to Domain India Business Email?
No. Domain India Business Email is a separate product with its own webmail at mail.yourdomain.com on port 8443 and its own settings.
Ready to set up professional email on your own domain? Compare Business Email with the mailboxes included in cPanel hosting, or open a ticket if you need help choosing.
Mailboxes at your own domain with webmail, calendar, contacts and two-factor authentication, priced per mailbox.
See Business Email