Recruiter guide | Updated 30 October 2026
How to create a Gmail app password for IMAP
Gmail will not let most desktop apps sign in with your normal Google password. If a mail app asks for your Gmail password and rejects it, you need an app password: a separate 16-character password that works for one app only. It takes about two minutes to create, and you can revoke it later without changing your real password.
What an app password is
An app password is a second password for your Google account, made for a single app. Your real Gmail password is never typed into the app, and the app password can be deleted at any time from your Google account. Google shows it once, when you create it; if you lose it, delete the entry and make a new one.
The 16 characters are usually grouped in four blocks of four. Spaces are only for readability: if the app accepts the password without spaces, either form works.
Before you start: turn on 2-Step Verification
Google only offers app passwords when 2-Step Verification is active on the account. If it is already on, skip to the next section.
- Open your Google Account at
myaccount.google.com. - Choose Security in the left-hand menu.
- Under How you sign in to Google, select 2-Step Verification and follow the prompts.
You will need your phone or another second factor for this step. Once it is on, return to the app password page.
Create the app password
- Go to
myaccount.google.com/apppasswords. You can also type App passwords into the search bar at the top of your Google Account and open the result. - Sign in again if Google asks.
- Enter a name you will recognise later, for example Applicant Packager.
- Select Create.
- Copy the 16-character password Google shows. It will not be shown again.
Paste it straight into the mail app, or into a password manager if you use one. Do not email it to yourself or keep it in a plain text file.
Use it in Applicant Packager
In Applicant Packager, open Manage accounts, choose Other provider (IMAP + app password), and enter:
| Setting | Value |
|---|---|
| IMAP server | imap.gmail.com |
| Port | 993 |
| Security | SSL/TLS |
| Username | Your full Gmail address, including @gmail.com |
| Password | The app password you just created |
Use Test & List Folders to confirm the login before saving. Applicant Packager opens the mailbox read-only: it can read messages and attachments, but it cannot send, delete, move, or mark anything as read.
Not connected yet? The Gmail bulk-download guide walks through the whole workflow, and the general CV download guide covers other mailboxes.
If it doesn't work
The "App passwords" option is missing. This usually means one of four things:
- 2-Step Verification is off. Turn it on first.
- The account uses Google's Advanced Protection Program, which blocks app passwords by design.
- It is a work or school account (Google Workspace) and an administrator has disabled app passwords. Ask the admin to enable them, or to create an app-specific password policy.
- You are signed in to the wrong Google account. Check the avatar in the top-right corner.
The login is rejected. Re-copy the password (it is easy to miss a character), confirm the username is the complete address including the domain, and generate a fresh app password if the old one was deleted. Make sure the port is 993 with SSL/TLS on.
Do not turn on "Less secure app access". That setting is gone, and it was never the right fix. Gmail's IMAP access is always available; the app password is what authorises the app.
Revoke an app password
Open myaccount.google.com/apppasswords, find the entry you created, and delete it. Access stops immediately for the app that was using it. Delete old entries you no longer recognise, and create one password per app rather than sharing a single password between tools. Changing your Google password does not automatically revoke existing app passwords, so remove them here when you stop using an app.
Questions recruiters ask
Is it safe to give an app password to a desktop app?
It is safer than giving out your real password. The password is limited to one app, can be revoked at any time, and Applicant Packager only reads your mailbox. Keep the app itself on a computer you control.
Does this turn off 2-Step Verification?
No. Your normal sign-in still uses two steps; the app password is a separate credential for that one app.
Will this work with other mail apps?
Yes. Any app that supports Gmail over IMAP can use the same app password. Create a separate password for each app so you can revoke one without affecting the others.
Does Gmail still need an IMAP toggle?
No. IMAP is always on for Gmail, so there is no setting to enable in Gmail's Forwarding and POP/IMAP page.
Download Applicant Packager free