IMAP password for Gmail: the app password setup guide

If you've tried connecting Gmail to a third-party email client or automation tool lately, you've probably hit an authentication wall. Google no longer accepts your regular Gmail password for IMAP connections. Instead, you need an imap password for gmail — specifically, a Google app password — that acts as a bridge between your inbox and external services.

Gmail serves over 1.8 billion active users worldwide (Google, 2024), and in May 2022, Google disabled "less secure app access" entirely. That means every IMAP connection now requires either OAuth 2.0 or an app password. For most automation workflows on CodeWords, an app password is the fastest path to a working email pipeline.

Unlike generic AI automation posts, this guide shows real CodeWords workflows — not just theory. You'll generate a working app password and connect it to automated email processing in minutes.

TL;DR

• Google app passwords replace your regular Gmail password for IMAP connections since "less secure app access" was removed in 2022
• You must enable 2-Step Verification on your Google account before generating an app password
• CodeWords uses your app password to build email automation — parsing, forwarding, responding — without managing OAuth tokens

Why can't you use your regular Gmail password for IMAP?

Google's decision to block regular passwords for IMAP wasn't arbitrary. Regular passwords expose your entire Google account — Drive, Photos, Payments — to any service that holds the credential. A single breach in a third-party email client could compromise everything.

App passwords solve this by creating a scoped, revocable credential. Each app password is a 16-character string tied to a specific device or application. If it's compromised, you revoke just that password without changing your main account credentials or disrupting other connected services.

This model follows the principle of least privilege, and it mirrors how platforms like Airtable and Reddit handle API authentication — purpose-built tokens instead of master passwords.

How do you generate an IMAP password for Gmail?

The process requires 2-Step Verification to be enabled first. Here's the full walkthrough:

Step 1: Enable 2-Step Verification

1. Go to myaccount.google.com/security
2. Under "How you sign in to Google," click 2-Step Verification
3. Follow the prompts to add a verification method (phone, authenticator app, or security key)

Step 2: Generate the app password

1. Visit myaccount.google.com/apppasswords
2. You may need to re-enter your Google password
3. In the "App name" field, type something descriptive (e.g., "CodeWords email automation")
4. Click Create
5. Google displays a 16-character password in the format xxxx xxxx xxxx xxxx

Copy this immediately. Google shows it only once. If you lose it, you'll need to generate a new one — but that takes seconds.

Step 3: Use the app password for IMAP

Configure your email client or automation tool with:

• IMAP server: imap.gmail.com
• Port: 993
• Encryption: SSL/TLS
• Username: Your full Gmail address
• Password: The 16-character app password (without spaces)

Also enable IMAP in Gmail's settings: Settings → See all settings → Forwarding and POP/IMAP → Enable IMAP.

What if you can't find the app passwords page?

2-Step Verification isn't enabled. The app passwords option only appears after you activate 2-Step Verification. Google enforces this because app passwords bypass the second factor — they're meant for services that can't handle interactive 2FA prompts. See Google's documentation.

Your account is managed by an organization. Google Workspace admins can disable app passwords at the org level. Check with your IT admin or use OAuth 2.0 instead.

Advanced Protection Program accounts block app passwords entirely. OAuth through CodeWords integrations is the alternative.

How do you connect your IMAP password to CodeWords?

Once you have your app password, CodeWords can use it to build email-driven automations. Store the credential as an environment variable in your CodeWords workspace, then use it in Python-based workflows.

Common patterns include:

• Email parsing: Monitor an inbox for invoices, receipts, or alerts and extract structured data using an LLM. The platform gives you access to OpenAI, Anthropic, and Gemini without managing separate API keys.
• Auto-forwarding with logic: Route emails to different Slack channels or team members based on content or sender patterns.
• Email-to-spreadsheet pipelines: Parse incoming data and push it to Google Sheets or Airtable for tracking.
• Digest generation: Aggregate email summaries using AI and deliver them via WhatsApp or Slack.

Browse templates for pre-built email workflows.

What are the security best practices for Gmail app passwords?

App passwords are convenient, but they need careful handling:

One password per service. Generate a separate app password for each tool or workflow. If one is compromised, you revoke it without disrupting other connections. Google's security documentation recommends this approach explicitly.

Store passwords in environment variables, not code. Never hardcode an app password in a script or commit it to version control. CodeWords provides secure environment variable storage for exactly this purpose.

Audit regularly. Visit myaccount.google.com/apppasswords periodically and revoke any passwords you no longer use. According to a 2024 Verizon Data Breach Investigations Report, credential misuse remains involved in over 40% of breaches.

Consider OAuth for production. App passwords work well for personal automation and prototyping. For production systems handling sensitive data at scale, Google OAuth 2.0 with proper credentials offers finer access control and automatic token rotation.

How does IMAP compare to the Gmail API?

IMAP is a standard protocol that works with any email provider and requires minimal setup — server, port, username, and your imap password for gmail. Python's imaplib (part of the standard library) connects with a few lines of code. The limitation: IMAP handles read/move/delete operations, not Gmail-specific features like labels or thread grouping.

The Gmail API provides full access to Gmail features through a REST interface, using OAuth 2.0 for authentication. The tradeoff is more setup: you need a Google Cloud project, enabled APIs, and OAuth credentials.

For straightforward email automation, IMAP with an app password is faster to configure. For label management and thread-level operations, the API is worth the extra setup. CodeWords supports both — check pricing for plan details.

FAQ

Do Gmail app passwords expire? No. App passwords remain valid until you manually revoke them or disable 2-Step Verification on your Google account. However, Google can revoke them if suspicious activity is detected.

Can I use one app password for multiple IMAP connections? Technically yes, but Google recommends generating one per application. Separate passwords let you revoke access to a single service without disrupting others.

Does generating an app password weaken my account security? An app password bypasses 2-Step Verification for that specific connection. It's less secure than OAuth but significantly safer than the old "less secure app access" method, because each password is independently revocable.

Will IMAP with an app password work with Google Workspace accounts? Yes, if your Workspace admin hasn't disabled app passwords. If the option is blocked, ask your admin to allow it or switch to OAuth 2.0 using a Google service account.

Beyond the password: what email automation makes possible

An imap password for gmail is a five-minute setup. The real opportunity is what happens after — automated inbox triage, AI-powered email parsing, and cross-platform workflows that turn unstructured email data into structured actions.

Most teams treat email as a manual inbox. The ones pulling ahead are treating it as an event stream. CodeWords gives you the serverless infrastructure, LLM access, and integrations to build that stream without managing servers or token refresh. Start your first email automation at codewords.agemo.ai.