How to create a Google app password

An app password is a 16-character code that lets one specific application sign in to your Google account. It is what the Inbox module — the email client inside ImmCase — currently uses to connect a Gmail account, so you will need one before your mail will sync.

Checked against Google's documentation on 22 September 2026.

Before you start

There is one hard prerequisite, and it is the reason most people cannot find the page:

  • 2-Step Verification must be turned on for the Google account. Google requires it before app passwords exist at all — there is no way around this, and no setting that replaces it.
  • You need to be signed in to the account you are creating the password for, not a different one in the same browser.
  • Have the application you are connecting open and ready. The password is shown once and cannot be retrieved afterwards.

Creating the password

Google changes the layout of these screens from time to time, so this gives you the address and the decisions rather than a click path that will go stale.

  • 1. Open the app passwords pageGo to myaccount.google.com/apppasswords and sign in if you are asked to. If it refuses to load, skip to "If you cannot see the option" below — that is the expected behaviour when something is missing.
  • 2. Name itType a name that says what it is for — "ImmCase Inbox", for instance. The name is only a label for you; it changes nothing about what the password can do. Then create it.
  • 3. Copy the 16 charactersGoogle shows a 16-character password, usually displayed in four blocks of four. It is shown once — copy it before you close the window.
  • 4. Paste it into ImmCaseIn ImmCase, open the Inbox module and add your Gmail account. Paste the app password where you are asked for the account password — not your normal Google password. The spaces are only there to make it readable; if it is rejected, enter it without them.

If you cannot see the option

This is the most common problem, and it is nearly always one of these four:

  • 2-Step Verification is off. Turn it on for the account, then return to the page — this accounts for most cases.
  • It is a work or school account, and the administrator has turned app passwords off for the organisation. You cannot override that yourself — ask whoever manages your Google Workspace.
  • The account uses security keys only, or Advanced Protection. Google withholds app passwords from those accounts by design.
  • You are signed in as the wrong account. Check which account the page opened as before assuming the feature is missing.

Treat it like a password, because it is one

An app password grants access to your mail without going through 2-Step Verification — that is the whole point of it, and it is also the risk. Anyone holding it has that access until it is revoked.

  • Create one per application, so revoking the ImmCase one does not break anything else.
  • Never email or message it. Paste it straight into the application.
  • Revoke it the moment an application is no longer used — same page, same place.
  • If a staff member leaves, revoke the ones they set up.

Revoking one

Go back to myaccount.google.com/apppasswords. Every password you have created is listed by the name you gave it, with the option to remove it. Removing one stops that application connecting immediately; it does not affect your Google password or any other app.

This is why step 2 is worth doing properly — a list of app passwords all called "mail" is a list you cannot safely prune.

Still stuck?

If the page will not load, the administrator has disabled it, or the password is rejected after you paste it, write to us — tell us which of the four cases above matches what you are seeing and we can usually sort it in one reply.

Back to all resources.