Less Secure Apps on Gmail: What They Are, Why Google Blocked Them, and What to Use Instead

What Are Less Secure Apps on Gmail?

Less secure apps are email clients, scripts, and automation tools that connect to Gmail using older authentication protocols like IMAP or SMTP with just a username and password, rather than the safer token-based system Google now requires. Because they store credentials in a way that is harder to verify and easier to steal, these apps became a favorite target for attackers attempting credential stuffing and phishing. Over time, Google shifted its security posture to block them by default, reducing the chance that a compromised password could immediately grant full mailbox access. Users who still rely on outdated clients or custom scripts often see login failures or security alerts, even when they have not changed anything on their end. The block is part of a broader industry move toward phishing-resistant sign-in methods and away from simple password-based SMTP authentication.

Why Google Blocked Access for Less Secure Apps

Google disabled less secure apps on Gmail to close a persistent vulnerability vector. When a script or client logs in with plain credentials, it bypasses the additional checks built into modern sign-in flows, making it easier for malicious actors to use stolen usernames and passwords from data breaches to access mailboxes at scale. The company has pushed developers and users toward OAuth 2.0, which issues limited, revocable tokens instead of storing account passwords in third-party software. This protects against unauthorized access and makes it easier for users to see which apps have permission to read email. The security block affects both personal Gmail accounts and Google Workspace accounts, though administrators can control settings in Workspace through the admin console. Despite warnings, some users kept enabling less secure apps until the feature was removed entirely in later stages, pushing everyone toward better authentication habits.

How to Check Your Gmail Less Secure Apps Setting

If you still see references to the feature, you can verify whether less secure app access is allowed by visiting the Security settings in your Google Account. Navigate to the Security section and look for entries related to third-party apps with account access. Google removes the explicit toggle for less secure apps on Gmail in most current views, but enterprise administrators may still control related API access or legacy sign-in options through Workspace admin tools. For most users, the setting no longer appears as an on-off switch. Instead, they are redirected to create app passwords or use OAuth-based tools. If a login attempt fails because a client uses outdated authentication, the error message usually points to the need for an app password or an update to the software you are using. Checking these areas helps you determine whether the block is affecting your setup or whether the issue is unrelated to Google's security changes.

What Still Works After the Less Secure Apps Removal

Many users ask whether they can still connect third-party email clients once less secure apps on Gmail are disabled. The answer depends on the client and its authentication method. Modern apps that use OAuth 2.0 continue to work without interruption. You can connect Outlook, Apple Mail, Thunderbird, and most popular software to Gmail using standard OAuth flows. When signing in, they ask for permission through Google's secure screen, and you do not hand over your password directly. Some older applications that rely only on IMAP and SMTP with username-password authentication, however, may fail unless you create a dedicated app password. App passwords bypass the normal sign-in process for specific devices and applications, letting them connect safely even if they do not support OAuth. They are tied to your Google account and can be revoked at any time without changing your main password. If you manage scripts or services that send email, check whether they support OAuth-based SMTP or require a special app password to function.

How to Create an App Password for Your Gmail Account

To create an app password, go to your Google Account Security settings and look for app passwords under the Signing in to Google section. Select the app and device you want to generate one for, then copy the password that appears. Use it in your email client or script instead of your regular account password. This method is useful for devices that do not support modern OAuth but still need to access mail over IMAP or SMTP. Google's support pages walk through the steps for each operating system and email client. Once an app password is saved, it works until you remove it from your account. If you no longer use that device or service, delete the password to reduce exposure. App passwords are separate from your main Google password, so they do not affect other sign-in sessions. The process allows older tools to continue working safely while you stay protected by the stronger authentication model Google now enforces.

Why You Should Avoid Scripts That Rely on Password Authentication

Scripts that use username and password for SMTP are the core use case behind less secure apps on Gmail. They are convenient for quick setups but expose credentials in configuration files or code repositories. If that script is compromised, attackers can send spam or read mail from the account. Google now enforces token-based access or app passwords for these scenarios to reduce the risk. You should audit any automation that connects to Gmail and confirm it uses OAuth or an app-specific credential. This is especially important for CI pipelines, server-side scripts, and shared codebases. Rotating credentials regularly and storing them in a secrets manager, rather than in plain text, adds another layer of protection. The general recommendation is to use Google's own libraries for email sending whenever possible, as they handle authentication correctly and reduce the chance of misconfiguration.

Common Errors and Troubleshooting

When less secure apps on Gmail are blocked, users often see a verification prompt or a security alert during login. The exact message varies by client. Some show a generic authentication failure; others mention that the app is not using a secure connection. Google's documentation lists error codes for SMTP and IMAP failures that can help you determine if the issue is related to credential type. If you see a block related to access from less secure apps, you may need to update the client or generate an app password. You should also confirm that two-step verification is enabled on the account, as app passwords are usually only available when it is active. If the account is managed through an organization, contact the admin to check API access policies or OAuth consent settings. You can also review recent activity in the Google Security Account to see which apps have been granted access and revoke any you no longer use. Keeping this list short reduces the chance of unauthorized third-party access.

Moving Forward Safely After the Less Secure Apps Removal

The removal of less secure apps on Gmail is not a temporary restriction but a permanent change in Google's access model. Users and developers should update their workflows to rely on OAuth 2.0, app passwords, or Google-provided libraries. These options are more secure and are more likely to work reliably as Google updates its systems. If you manage multiple accounts or services, document which credentials each app uses and how it authenticates. This makes audits easier and helps you spot outdated clients before they cause failures. Check Google's official support pages for the latest requirements. Third-party documentation may be outdated and still refer to the old less secure apps setting. Confirm any steps with current Google guidance before changing production systems. Use test accounts to validate new configurations before rolling them out widely.