If you use Gmail with older devices or email clients, app passwords can be a practical security workaround.
This guide explains how to remove Gmail app passwords, when you should revoke them, and what to do if you no longer see the option.
What Gmail app passwords are
Gmail app passwords are 16-digit codes created in your Google Account for apps or devices that do not support modern sign-in methods such as two-factor authentication and OAuth.
They are commonly used with desktop mail clients, older phones, scanners, printers, and some third-party email applications.
Unlike your regular Google password, an app password is limited to a specific app and device.
That restriction is useful, but it also means unused or forgotten app passwords can become a security risk if they remain active.
Why you might want to remove Gmail app passwords
There are several reasons to revoke app passwords from your Google Account:
- You no longer use the app or device that needed it.
- You suspect an old device is still signed in.
- You changed your email setup to use modern authentication.
- You are cleaning up unused access after replacing a phone, laptop, or mail app.
- You want to reduce the number of active credentials tied to your account.
Removing unused app passwords is a straightforward way to tighten account security without changing your main Google password.
Before you remove an app password
Check whether the app or device still depends on that password.
If you revoke it while it is in active use, email sync or sign-in may stop working until you create a new one or update the app to support a more secure sign-in method.
If you are unsure which app the password belongs to, review the label shown in your Google Account.
Google usually displays the app name and device name associated with each app password, which helps you identify what can safely be removed.
How to remove Gmail app passwords
You can remove Gmail app passwords from the Google Account security settings.
The process is quick and works from a browser on desktop or mobile.
- Sign in to your Google Account.
- Open the Security section.
- Look for How you sign in to Google.
- Select App passwords.
- Review the list of app passwords currently active on your account.
- Choose the password you want to remove.
- Click or tap the Delete icon or remove option.
- Confirm the action if prompted.
Once deleted, that app password can no longer be used to access Gmail or other Google services linked to the account.
How to remove all Gmail app passwords at once
If you want to revoke every app password tied to your account, the fastest approach is usually to change your Google Account password or disable and re-enable app password access where applicable.
In many cases, changing your main password invalidates existing app passwords automatically.
This option is useful if you believe an app password may have been exposed or if you want a broad reset after a security issue.
Afterward, any app or device that depended on those passwords will need to sign in again or be reconfigured.
What happens after you delete an app password?
Deleting an app password removes that app’s access immediately.
The affected app may show a sign-in error, stop syncing mail, or ask you to re-enter credentials.
Devices like printers or scanners may fail to send email until a new password is created or a modern authentication method is configured.
Your primary Google Account password does not change when you delete an app password.
Only the selected app-specific credential is revoked.
How to confirm an app password is no longer active
After deletion, return to the App passwords page in your Google Account.
The removed entry should no longer appear in the list.
If you use the same app again, it should fail to authenticate unless it has another active password or supports a newer login method.
You can also monitor recent account activity in Google Security settings.
Unexpected sign-ins, unfamiliar devices, or repeated authentication errors may indicate that a device still needs attention.
What if you do not see the App passwords option?
Google does not offer app passwords on every account.
The option may be missing if:
- Two-step verification is not turned on.
- Your account is managed by an employer, school, or organization.
- Your account uses advanced security settings that block app passwords.
- Your Google Workspace administrator has disabled the feature.
In those cases, you may need to enable two-step verification first or ask your administrator about supported sign-in methods.
Some accounts now use OAuth-based login exclusively, which makes app passwords unnecessary.
How to replace an app password with a safer option
If an app or device supports modern authentication, switch to that instead of continuing to use an app password.
OAuth-based sign-in is generally more secure because it avoids sharing your main password or a long-lived app-specific credential.
Common alternatives include:
- Using the app’s built-in Google sign-in flow.
- Updating to a newer version of the email client.
- Connecting the device through a supported Google account integration.
- Using Gmail in a browser when possible.
For legacy tools that cannot be updated, app passwords may still be necessary, but they should be limited to the minimum number of devices required.
Security tips for managing Gmail app passwords
Good credential hygiene matters, especially for email accounts that often serve as recovery hubs for banking, shopping, and social media.
- Delete app passwords you no longer recognize or use.
- Label each password clearly so you can identify it later.
- Keep two-step verification enabled on your Google Account.
- Review your account’s security activity regularly.
- Replace old devices that rely on outdated authentication methods.
If you manage multiple devices, make a habit of reviewing app passwords whenever you upgrade hardware or switch email clients.
That keeps your account easier to audit and reduces the chance of forgotten access persisting for months or years.
When to change your Google password instead
Deleting a single app password is enough when only one device or client needs to be removed.
However, if you think your credentials may have been exposed, changing your Google password is the stronger move because it can invalidate multiple old sign-in paths at once.
After changing the main password, check your active sessions, connected devices, and app passwords to make sure nothing unexpected remains attached to the account.