Gmail Less Secure Apps Setting Explained (and What Replaced It)

If you have ever set up Gmail in an old desktop client or a scanner, you have met “Allow less secure apps” — the toggle that let any app sign in with nothing more than your username and password. It is gone now, and that is the source of a small flood of “my password suddenly stopped working” confusion. I went hunting for the setting in my own Google Account Security page while writing this and confirmed there is no toggle left to flip. Here is exactly what that setting did, when Google retired it, and the OAuth-and-App-Password path you use in its place — so you can connect SMTP and IMAP today without chasing a switch that no longer exists.

What the Setting Did

The “allow less secure apps” setting let apps and devices sign in to your Google Account with only your username and password — what Google calls Basic Authentication — instead of the safer OAuth flow. It existed so older mail clients, scanners, and scripts that couldn’t handle a browser login could still reach Gmail.

The name was always a little misleading. A “less secure app” was not malware — it was simply any app that authenticated the old way: send Google a username, send Google a password, get let in. Per Google Account Help, this is access “with only your username and password,” and Google contrasts it with a “more secure type of access that doesn’t share password data.”

The reason Google calls that less secure is straightforward. When an app holds your actual password, a single leak — a breached client, a logged credential, a phishing page — hands an attacker everything they need to read your mail. There is no second barrier. The toggle existed because a generation of mail clients, multifunction printers, and homegrown SMTP scripts were built before OAuth and only knew how to send a plain password. Turning the setting on told Google to accept that, with full knowledge of the trade-off. If you are weighing how exposed your account is, the same logic that retired this setting is why turning on 2-Step Verification matters: it removes the “password alone is enough” weakness the setting created.

When Google Retired It

Google removed the “Allow less secure apps” toggle from personal Gmail accounts on 30 May 2022. For Google Workspace, it removed the admin control on 15 June 2024 and turned off less secure app access for all Workspace accounts by 30 September 2024. The setting no longer exists for anyone.

The retirement happened on two tracks. Personal Gmail accounts lost the toggle first, on 30 May 2022 — after that date there was simply nothing in Security to switch on or off. Google Workspace accounts followed on a published timeline: per Google Workspace Updates, “the LSA settings will be removed from the Admin console” on 15 June 2024, and “access to LSAs will be turned off for all Google Workspace accounts” on 30 September 2024.

That is why the search you may have just run came up empty. Open your Google Account, go to Security, look for “less secure apps” — and there is no result. The setting was not hidden or moved; it was deleted. Google’s stated reason was to push everyone onto “the industry standard and more secure OAuth method of authentication already used by the vast majority of third-party apps.” Any guide, forum answer, or printer manual still instructing you to “enable less secure apps in Gmail” is describing a control that has not existed for years.

The Replacement: OAuth

The modern path is OAuth, surfaced in apps as “Sign in with Google.” Instead of handing the app your password, you log in through a Google window in your browser and the app receives a revocable token. Modern clients — the Gmail app, Apple Mail, recent Outlook, Thunderbird — all support it, and it needs no App Password.

OAuth is what the whole transition was built around. With OAuth, your mail client never sees your password at all. You click Sign in with Google, a real Google login window opens in a browser, you authenticate there (including any 2-Step Verification prompt), and the app walks away with a scoped, revocable access token instead of your credentials. If the app is ever compromised, you revoke its token from your account — your password is untouched and unexposed.

For the large majority of people, this is the entire answer: pick a client that offers “Sign in with Google,” use it, and you never think about less secure apps or App Passwords again. The Gmail app, Apple Mail, current versions of Outlook, and Thunderbird all support the Google OAuth flow. If you just need SMTP or IMAP today and your client has a “Sign in with Google” button, use it — you are done. The App Password route below exists only for the apps that genuinely can’t do this. And because OAuth ties access to your account login, it pairs naturally with the rest of your security setup, from your account password to your recovery options.

When You Still Need an App Password

If a device or script can only send a username and password — older scanners, multifunction printers, and SMTP-only scripts that never adopted OAuth — you use a 16-digit App Password. First turn on 2-Step Verification, then generate the App Password and enter it in place of your normal Gmail password in the SMTP or IMAP settings.

Not everything can do OAuth. A 2017 office scanner, a monitoring script that just opens an SMTP socket, an embedded device with a firmware that will never be updated — these can only do one thing: send a username and a password. For exactly these cases, Google kept a door open, and it is the App Password.

Per Google Account Help, an App Password is “a 16-digit passcode that gives a less secure app or device permission to access your Google Account,” and it “can only be used with accounts that have 2-Step Verification turned on.” The mechanism in order:

1. Turn on 2-Step Verification. App Passwords don’t exist without it. Open your Google Account, go to Security, and turn on 2-Step Verification.
2. Create the App Password. Search your Google Account for “App passwords” and generate one. Google shows you a 16-character code, once.
3. Use it instead of your password. In the legacy app’s SMTP or IMAP settings, enter the 16-digit App Password where you would normally type your Gmail password. Your username stays the same.

That is the modern answer to every “gmail smtp less secure” question: there is no toggle, there is a scoped 16-digit credential that only works because 2-Step Verification is guarding the account. Google now frames App Passwords as a last resort — fine when an app truly can’t use OAuth, but not the first thing to reach for.

What This Does Not Fix

An App Password is not a full return to the old days. It is scoped to one app and revocable, but it is still a static credential, so treat it carefully. And neither OAuth nor App Passwords helps if the underlying problem is a weak account password or a compromised account — those need their own fixes.

A few honest limits keep this from becoming a false comfort:

• An App Password is still a static secret. It is far better than exposing your real password — it is scoped to one app and you can revoke it alone — but if you paste it into an insecure script or a device that later gets breached, that one connection is exposed. Revoke any App Password the moment a device leaves your hands.
• 2-Step Verification is a prerequisite, not optional. You cannot create an App Password without it, which is by design: the App Password is only as trustworthy as the second factor standing behind it. If you have been avoiding 2-Step Verification, this is the nudge to finally turn it on.
• None of this rescues a compromised account. If the real issue is that someone else has your password, App Passwords and OAuth won’t help — you need to change your password and, if there are signs of intrusion, work through the account-recovery steps. The less secure apps change closed one door; it does not lock the others for you.
• Some features sit outside this entirely. Sending mechanics like SMTP authentication are separate from inbox features such as confidential mode — fixing how an app signs in won’t change what those features do.

Verdict

The less secure apps setting is gone for good — removed from personal Gmail in 2022 and from Workspace in 2024 — and it is not coming back. For almost everyone the replacement is “Sign in with Google” (OAuth); for the handful of devices that can’t do OAuth, the answer is a 16-digit App Password backed by 2-Step Verification.

Best for OAuth: anyone whose mail client offers “Sign in with Google.” Use it and you never deal with passwords, App Passwords, or this whole topic again — the app gets a revocable token and your credentials stay with Google.

Use an App Password if: your device or script can only send a username and password — an older scanner, a multifunction printer, an SMTP-only script. Turn on 2-Step Verification, generate the 16-digit code, and drop it into the app’s settings in place of your password.

Skip the hunt entirely if you are still looking for the toggle. It does not exist on any Google account today, and no setting, lab flag, or admin control will bring it back. The moment an app reports a wrong password after years of working, assume it relied on the retired access, and jump straight to OAuth or an App Password rather than searching Security for a switch that was deleted.

Alexis Dollé

Founder & Editor

Alexis Dollé, email expert for 10+ years. Founder of Email Tools. I test every email client and utility myself, then write about them the way I’d explain them to a friend — no marketing fluff, no sponsored rankings, every claim sourced.

LinkedIn

Related: Gmail App Passwords for SMTP and IMAP — the practical replacement, step by step. Set up 2-Step Verification on Gmail — the prerequisite for any App Password. What to do if your Gmail is compromised — when the real problem is bigger than a setting. Change your Gmail password — the other half of locking down access.