# 535-5.7.8 Username and Password not accepted (Gmail)

Gmail answers 535-5.7.8 when it refuses the SMTP login. Why your normal password stops working in Nodemailer and apps, and how an app password fixes it.

Author: Formgong
Published: 2026-10-16
Language: en
Canonical: https://formgong.com/en/blog/gmail-smtp-535-username-and-password-not-accepted/

535-5.7.8 means Gmail rejected the username and password your code sent. Gmail does not accept your normal Google password from Nodemailer, PHPMailer or other apps: turn on 2-Step Verification, create an app password, and use it as the SMTP password with your full Gmail address as the user. Also check that the variables your code reads are really set.

## The exact reply

*Figure: A contact form shows an error after Send. The server terminal shows Nodemailer's Invalid login error with Gmail's reply 535-5.7.8 Username and Password not accepted.*

On 16.10.2026 we pointed Node.js 22.23 and nodemailer 10.1.1 at `smtp.gmail.com` on port 587 with an address that has no account behind it and a random password. Gmail answered in about 0.7 seconds, and Nodemailer threw this:

`Error: Invalid login: 535-5.7.8 Username and Password not accepted. For more information, go to 535 5.7.8 https://support.google.com/mail/?p=BadCredentials`

The error object had `code: "EAUTH"`, `responseCode: 535` and `command: "AUTH PLAIN"`. Port 25 gave the same reply. The text is the same whether the address does not exist or the password is wrong, so it does not tell you which half is the problem. Check both.

## The usual cause: a normal Google password

Most people hit this error with code that is correct, because they put their everyday Google password into `SMTP_PASS`. Google's help page that the error links to says signing in from an app may need an app password. In practice Gmail refuses the normal password from SMTP clients, so the fix is:

- Turn on 2-Step Verification for the Google account. The app password option does not appear without it.

- Create an app password in your Google account's security settings and copy it.

- Use it as the SMTP password. The user is your full address, such as `you@gmail.com`.

- Store both as secrets on the server, never in page code.

If it worked for months and then stopped, look for a password change on the account: Google's help says app passwords are revoked when you change your Google password. Create a new one.

On a work or school account, Google's page notes that you may not see the app password option at all. Then the organisation's admin decides how apps may sign in.

## Check what your code really sends

Before you blame Google, print the length of the user and password your server reads, not the values. An empty or wrong variable produces either this error or [“Missing credentials for "PLAIN"”](/en/blog/nodemailer-missing-credentials-for-plain/). `transporter.verify()` connects and logs in without sending anything, so you can test the login on its own.

```javascript
// Fail at startup with a clear message instead of failing on the first visitor's message.
for (const name of ["SMTP_HOST", "SMTP_PORT", "SMTP_USER", "SMTP_PASS"]) {
  if (!process.env[name]) throw new Error(`${name} is not set`);
}

const transporter = nodemailer.createTransport({
  host: process.env.SMTP_HOST,
  port: Number(process.env.SMTP_PORT),
  secure: Number(process.env.SMTP_PORT) === 465, // true only for 465
  auth: { user: process.env.SMTP_USER, pass: process.env.SMTP_PASS },
});

await transporter.verify(); // connects and logs in, sends nothing
```

## Do you need Gmail SMTP for a contact form?

If the SMTP login exists only so a contact form can email you, you can drop it: a form that posts to [Formgong](/en/) at `https://formgong.com/submit` has no SMTP host, port or password in your code, and Formgong sends the notification itself. See the [HTML guide](/en/docs/html/).

## Frequently asked questions

### What does 535-5.7.8 Username and Password not accepted mean?

Gmail's SMTP server rejected the login your code sent. Either the address is wrong, or the password is not one Gmail accepts from apps. Use an app password.

### Why does Gmail reject my correct password in Nodemailer?

Gmail does not take your normal Google password from SMTP clients. Turn on 2-Step Verification, create an app password and use that as the SMTP password.

### My Gmail SMTP stopped working after a password change. Why?

Google's help says app passwords are revoked when you change your Google password. Create a new app password and update the secret on your server.

### Does the 535 error mean the account does not exist?

Not necessarily. We got the same text for an address with no account, so the reply does not say which part of the login was wrong.

## Sources and documentation

- [Google: BadCredentials help page (linked from the error)](https://support.google.com/mail/?p=BadCredentials)
- [Google: Sign in with app passwords](https://support.google.com/accounts/answer/185833)
- [Nodemailer: SMTP transport](https://nodemailer.com/smtp/)
- [HTML contact form](https://formgong.com/en/docs/html/)

[Get a form key](https://formgong.com/en/#top)