Gmail 535-5.7.8 Username and Password not accepted: fix

What the error means

When an app, plugin or script signs in to smtp.gmail.com and Gmail refuses, you see one of these replies:

text

535-5.7.8 Username and Password not accepted. For more information, go to
535 5.7.8  https://support.google.com/mail/?p=BadCredentials

534-5.7.9 Application-specific password required. For more information, go to
534 5.7.9  https://support.google.com/mail/?p=InvalidSecondFactor

Libraries wrap them in their own words. Nodemailer throws Invalid login: 535-5.7.8 Username and Password not accepted with the code EAUTH. PHPMailer says SMTP Error: Could not authenticate. Python raises smtplib.SMTPAuthenticationError with the same 535 text.

535 5.7.8 is the standard SMTP reply for “authentication credentials invalid” (RFC 4954). Gmail checked the username and password and refused them. It doesn’t tell you which part was wrong, so work through the causes below.

Why Gmail rejects the login

Cause	How to tell	Fix
You used your normal Google password	The password works on gmail.com but not in your app	Create an App Password (steps below). Gmail SMTP doesn’t accept your account password from apps any more.
2-Step Verification is on and you sent the normal password	Reply is `534-5.7.9 Application-specific password required`	Same fix: an App Password.
The App Password was revoked	It worked before, then stopped after you changed your Google password	Google revokes all App Passwords when you change the account password. Create a new one.
Wrong username	You used a nickname, or an address from a different account	Use the full address of the account that owns the App Password, e.g. `you@gmail.com` or `you@yourcompany.com`.
Copy-paste damage	Extra quotes or a trailing newline in an `.env` file	Print the length of the password your code actually reads. An App Password is 16 characters.
Google wants a browser sign-in first	Reply is `534-5.7.14 Please log in through your web browser and then try again`	Sign in to Gmail in a browser, review any security alert, then retry.

1Turn on 2-Step Verification

Google only offers App Passwords on accounts with 2-Step Verification. Open Google Account → Security and turn on 2-Step Verification if it’s off.

2Create an App Password

Go to myaccount.google.com/apppasswords, type a name such as “Website” and create it. Google shows a 16-character code once. Copy it. That code is the SMTP password. Your Google password stays out of it.

3Use these SMTP settings

Host	`smtp.gmail.com`
Port	`465` with SSL/TLS on, or `587` with SSL off (STARTTLS)
Username	Your full Gmail or Google Workspace address
Password	The 16-character App Password
From address	The same address, or an alias you’ve added in Gmail

Every provider’s host and port is on the SMTP settings page.

No App passwords option?

Google lists three reasons the option doesn’t appear, besides 2-Step Verification being off:

Your 2-Step Verification is set up only with security keys.
You’re signed in to a work, school or other organization account.
The account uses Advanced Protection.

On a Google Workspace account, the admin controls this. In the Admin console, under Security → Authentication → 2-step verification, they need Allow users to turn on 2-Step Verification ticked. If they enforce Only security key, App Passwords are off: Google says “enforcing security keys disables app passwords”.

If your admin won’t allow App Passwords, use a sending service with your domain verified (Amazon SES, Brevo, Resend), or ask the admin about Google Workspace’s SMTP relay service (smtp-relay.gmail.com), which they set up in the Admin console.

What happened to “Less secure apps”?

“Less secure apps” was the old switch that let apps sign in with just your username and password. It’s gone. Google’s Workspace transition notice gives March 14, 2025 as the date that access was turned off for all Google Accounts. The Admin console setting no longer exists. Google says SMTP, IMAP and POP “will no longer work with legacy passwords”, with the exception of App Passwords. So for a script or plugin with a password field, an App Password is the only option. Everything else needs OAuth.

Test the login on its own

Before you debug your app, check the credentials by themselves. This Node.js script logs in without sending anything:

// npm install nodemailer
import nodemailer from "nodemailer";

const transport = nodemailer.createTransport({
  host: "smtp.gmail.com",
  port: 465,
  secure: true, // port 587 instead? set secure: false (STARTTLS)
  auth: {
    user: "you@gmail.com",                  // the full address
    pass: process.env.GMAIL_APP_PASSWORD,   // the 16-character App Password
  },
});

await transport.verify(); // connects, starts TLS and logs in, without sending
console.log("Gmail accepted the login");

If this works and your app still fails, the app is reading a different password or username than you think. If this fails with EAUTH, the problem is the account, not your code.

Login works but sending fails

“You have reached a limit for sending mail” or 550 5.4.5 Daily user sending limit exceeded: Gmail’s limit is 500 recipients a day on a free account, and Google Workspace accounts get 2,000 messages a day. Google says you can usually send again within 1 to 24 hours.
Emails land in spam or show “via”: the From address doesn’t match the account. See why contact form emails go to spam.
Timeouts instead of 535: your host is blocking the port. See SMTP connection timed out.

Using FormSMTP? FormSMTP is one way to put Gmail behind a website form without your server touching SMTP. Create a free project, pick Gmail / Google Workspace, paste the App Password and click Test connection. It runs the same check as the script above (connect, TLS, login) and shows Gmail’s reply word for word. Then follow the Gmail contact form guide.

Other errors? See the SMTP error code reference.

Sources

Checked on the vendors’ own pages on November 2, 2026.

FAQ

Why does Gmail say “Username and Password not accepted” when my password is right?

Because Gmail SMTP no longer accepts your normal Google password from apps. Turn on 2-Step Verification, create an App Password and use that 16-character code as the SMTP password.

What does “534-5.7.9 Application-specific password required” mean?

Your account has 2-Step Verification on and the app sent your normal password. Create an App Password at myaccount.google.com/apppasswords and use it instead.

Why don’t I see App passwords in my Google Account?

2-Step Verification may be off. Otherwise Google lists three reasons: 2-Step Verification is set up only with security keys, it’s a work or school account where the admin controls it, or the account uses Advanced Protection.

Can I turn “Less secure apps” back on?

No. Google removed it, and SMTP, IMAP and POP no longer accept plain account passwords. App Passwords (or OAuth) are what’s left.

Do App Passwords stop working?

They’re revoked when you change your Google password, and you can revoke them yourself. If a working setup suddenly gets 535, check whether the password was changed.