Google finished switching off “less secure app access” in 2025, and that one change is why your old Gmail settings suddenly stopped working in Mailbird, Thunderbird or Apple Mail: your normal password is no longer accepted. The servers and ports didn’t change — only the login did. I set this up in Thunderbird last week and got it connecting in under five minutes once I had the right values. Here are the exact Gmail SMTP TLS settings, every number sourced straight from Google, plus the one new step that trips everyone up.
The Exact Settings at a Glance
For outgoing mail, set smtp.gmail.com with port 465 for SSL or port 587 for TLS. For incoming mail, use imap.gmail.com on port 993 (SSL) or pop.gmail.com on port 995 (SSL). Your username is your full Gmail address; your password is a 16-digit App Password, not your normal one.
Every modern email client asks for the same handful of values. Here they are, each one taken directly from Google’s own documentation:
- Outgoing (SMTP) server:
smtp.gmail.com - SMTP port — SSL:
465 - SMTP port — TLS/STARTTLS:
587 - Incoming (IMAP) server:
imap.gmail.com, port993, SSL on - Incoming (POP) server:
pop.gmail.com, port995, SSL on - Username: your full address, e.g.
you@gmail.com - Password: a 16-digit App Password (covered below)
The SMTP server and ports come straight from Google Workspace Admin Help, which states plainly: “For SSL, enter 465. For TLS, enter 587.” The POP server and port 995 are from Google’s Gmail Help; the IMAP server imap.gmail.com on port 993 is Gmail’s documented IMAP setting. If you’re choosing between IMAP and POP, IMAP is almost always the right pick — our Gmail IMAP setup guide for Mailbird walks through why sync beats download for anyone reading mail on more than one device.
SSL Port 465 vs TLS Port 587
Both ports encrypt your mail; they differ only in how the encryption starts. Port 465 uses implicit SSL — encrypted from the first byte. Port 587 uses STARTTLS — it begins plain, then upgrades to TLS. Per Google, “For SSL, enter 465. For TLS, enter 587.” Either is safe.
This is the choice that confuses people most, and the honest answer is that it barely matters. Both ports give you an encrypted connection to Gmail; the only real difference is the handshake.
Port 465 (SSL/TLS, implicit). The connection is encrypted the moment it opens. If your email client offers a simple dropdown with “SSL/TLS” as one option, choosing it with port 465 is the most foolproof route — there’s no intermediate plaintext step to misconfigure.
Port 587 (STARTTLS, explicit). The connection opens in plain text, then immediately issues a STARTTLS command to upgrade to an encrypted channel. This is the standard “submission” port for sending mail, and many clients default to it. If your client’s encryption field literally says “STARTTLS”, pair it with 587.
What you should not use is port 25. That’s the legacy server-to-server relay port, and most home and office networks block it outright to fight spam — it’s not meant for a personal email client. Pick 465 or 587, match the encryption setting your client names, and move on.
Why You Now Need an App Password
Gmail no longer accepts your plain account password from third-party clients. You must turn on 2-Step Verification, then create a 16-digit App Password and use that instead. Per Google, an App Password “can only be used with accounts that have 2-Step Verification turned on.”
This is the single change that breaks old setups. For years you could type your Gmail address and password into any client and it worked. Google has since removed support for apps that ask for your plain username and password, finishing the shutdown of “less secure app access” in 2025. The settings above are correct, but they’ll still fail authentication if you paste your normal password.
The replacement is an App Password. Per Google Account Help, an App Password is a 16-digit passcode that “gives a less secure app or device permission to access your Google Account”, and it “can only be used with accounts that have 2-Step Verification turned on”. So the order is: enable 2-Step Verification first, then generate the App Password, then paste that 16-digit code into your client’s password field instead of your usual password. The username stays your full Gmail address. (If you’ve recently rotated your login, note that changing your main password is separate from this — see how a Gmail password change affects connected apps.)
Adding Gmail to Your Client Step by Step
Create the App Password, enter smtp.gmail.com (465 SSL or 587 TLS) for outgoing and imap.gmail.com:993 for incoming, set authentication to normal password with SSL/TLS on, paste the App Password, then send a test message to confirm both directions work.
The same five steps apply whether you’re in Thunderbird, Apple Mail, Outlook or Mailbird; only the menu labels change.
- Generate the App Password. Turn on 2-Step Verification in your Google Account, then create a 16-digit App Password and copy it.
- Add the account in your client and choose manual or IMAP setup if prompted (not “Sign in with Google”, if you want the classic server settings).
- Outgoing server:
smtp.gmail.com, port465(SSL) or587(TLS), encryption on, authentication “Normal password”. - Incoming server:
imap.gmail.com, port993, SSL on (or POPpop.gmail.com:995). Username is your full Gmail address; password is the App Password. - Send a test email to yourself and confirm it both sends and arrives.
If you’re running Gmail next to a work account, the same App-Password-plus-IMAP approach is how you wire them into one client — our guide on using Gmail and Outlook together covers that side-by-side setup.
Fixing the Two Most Common Errors
”Authentication failed” means the password is wrong for Gmail’s rules — fix it by pasting a fresh App Password, not your account password. “Could not connect” means the server name, port, or encryption is off — recheck smtp.gmail.com with 465/587 and imap.gmail.com:993 with SSL on.
Nearly every failed Gmail setup is one of two errors, and each has a clear cause.
“Authentication failed” / “username or password incorrect.” This is almost never a typo in your real password — it’s that Gmail won’t accept your real password at all from a client. Generate a fresh App Password, remove any spaces when you paste the 16 digits, and confirm the username is your complete @gmail.com address. If your account is one that’s not receiving mail at all after setup, that’s usually the same root cause: the incoming server authenticated with the wrong credential.
“Could not connect to server” / “connection timed out.” This points at the server, port or encryption, not the password. Re-check that the outgoing server is exactly smtp.gmail.com on port 465 or 587, the incoming is imap.gmail.com:993 (or pop.gmail.com:995) with SSL switched on, and that you haven’t accidentally entered port 25. A corporate firewall, VPN, or restrictive Wi-Fi can also block these ports — test on a different network to rule that out.
Quick Reference and Verdict
Use smtp.gmail.com with 465 (SSL) or 587 (TLS) for sending, imap.gmail.com:993 with SSL for receiving, your full address as username, and a 16-digit App Password as the password. The servers and ports are unchanged; the only new requirement is the App Password behind 2-Step Verification.
The whole configuration in one block:
- SMTP:
smtp.gmail.com— port465(SSL) or587(TLS) - IMAP:
imap.gmail.com— port993(SSL) - POP:
pop.gmail.com— port995(SSL) - Username: full Gmail address · Password: 16-digit App Password
Best for: anyone whose previously working Gmail client suddenly stopped sending or receiving. The settings above are current and sourced; nine times out of ten the only thing that changed is that you now need an App Password.
Skip the manual route if: your client offers “Sign in with Google” and you’re happy using it — that OAuth flow skips ports and App Passwords entirely. The manual SMTP/IMAP settings here are for clients that don’t, or for people who prefer the classic configuration.
Get the App Password right and the rest is just six values typed once. While you’re in your client, it’s worth learning the Gmail keyboard shortcuts and how to forward mail automatically — the settings above are the foundation everything else sits on.
Alexis Dollé, email expert for 10+ years. Founder of Email Tools. I test every email client and utility myself, then write about them the way I’d explain them to a friend — no marketing fluff, no sponsored rankings, every claim sourced.
LinkedInSources & references
- Google Workspace Admin Help, “Send email from a printer, scanner, or app” — Gmail SMTP server smtp.gmail.com; “For SSL, enter 465. For TLS, enter 587.”; authentication uses the full address and an App Password. Accessed 2026-06-23. knowledge.workspace.google.com — Send email from a printer, scanner, or app
- Google Gmail Help, “Read Gmail messages on other email clients using POP” — POP server pop.gmail.com, port 995, SSL required. Accessed 2026-06-23. support.google.com — Gmail POP settings
- Google Gmail Help, “Check your Gmail IMAP settings” — IMAP server imap.gmail.com, port 993, SSL; outgoing smtp.gmail.com. Accessed 2026-06-23. support.google.com — Gmail IMAP settings
- Google Account Help, “Sign in with App Passwords” — a 16-digit App Password “gives a less secure app or device permission to access your Google Account” and “can only be used with accounts that have 2-Step Verification turned on”. Accessed 2026-06-23. support.google.com — Sign in with App Passwords
Frequently Asked Questions
What are the correct Gmail SMTP TLS settings for an email client?
Set the outgoing server to smtp.gmail.com. For an SSL connection use port 465; for a TLS/STARTTLS connection use port 587. Per Google Workspace Admin Help, “For SSL, enter 465. For TLS, enter 587.” Use your full Gmail address as the username and a 16-digit App Password (not your normal password) as the password, with SSL/TLS enabled. Both ports are encrypted and either works — most clients default to 587 for submission.
Should I use port 465 or port 587 for Gmail SMTP?
Both are correct and both encrypt your connection — the difference is the handshake. Port 465 uses implicit SSL (the connection is encrypted from the first byte), while port 587 uses STARTTLS (it starts plain, then upgrades to TLS). Per Google, “For SSL, enter 465. For TLS, enter 587.” If your client offers a plain “SSL/TLS” toggle, 465 is simplest; if it asks for “STARTTLS”, use 587. Don’t use port 25 for a personal client — it’s the relay port and is widely blocked.
Why does Gmail reject my normal password in my email client?
Google removed support for third-party apps that ask for your plain Google username and password. To connect a client over SMTP or IMAP you must turn on 2-Step Verification and create a 16-digit App Password, then use that in place of your account password. Per Google Account Help, an App Password “gives a less secure app or device permission to access your Google Account”, and it “can only be used with accounts that have 2-Step Verification turned on”.
What are the Gmail IMAP and POP settings?
For IMAP, set the incoming server to imap.gmail.com on port 993 with SSL — IMAP keeps your mail in sync across every device, so it’s the better default. For POP, use pop.gmail.com on port 995 with SSL, which downloads mail to one device. In both cases the username is your full Gmail address and the password is your App Password. Make sure IMAP or POP is enabled under Gmail Settings before you connect.
I get ‘authentication failed’ when adding Gmail — how do I fix it?
An authentication failure almost always means the password is wrong for Gmail’s rules, not that you mistyped it. The fix: turn on 2-Step Verification, generate a fresh App Password, and paste that 16-digit code into the password field instead of your account password (remove any spaces). Confirm the username is your complete Gmail address. If it still fails, the App Password may have been created for the wrong app type — delete it and make a new one.
Why can’t my client connect to the Gmail server at all?
A ‘could not connect’ error points at the server name, port, or encryption setting rather than the password. Confirm the outgoing server is exactly smtp.gmail.com with port 465 (SSL) or 587 (TLS), and the incoming server is imap.gmail.com:993 or pop.gmail.com:995 with SSL on. A firewall, VPN, or office network that blocks these ports is the next suspect — try another network to isolate it.
Related: Gmail IMAP setup guide for Mailbird — the incoming side of these settings in practice. Gmail account not receiving emails — when incoming auth silently fails. Using Gmail and Outlook together — wiring two accounts into one client. How a Gmail password change affects apps — why connected clients break after a reset.