Gmail SMTP “535-5.7.8 Username and Password not accepted”: what it means and the fix

The exact reply

On 16.10.2026 we pointed Node.js 22.23 and nodemailer 10.1.1 at smtp.gmail.com on port 587 with an address that has no account behind it and a random password. Gmail answered in about 0.7 seconds, and Nodemailer threw this:

Error: Invalid login: 535-5.7.8 Username and Password not accepted. For more information, go to 535 5.7.8 https://support.google.com/mail/?p=BadCredentials

The error object had code: "EAUTH", responseCode: 535 and command: "AUTH PLAIN". Port 25 gave the same reply. The text is the same whether the address does not exist or the password is wrong, so it does not tell you which half is the problem. Check both.

The usual cause: a normal Google password

Most people hit this error with code that is correct, because they put their everyday Google password into SMTP_PASS. Google's help page that the error links to says signing in from an app may need an app password. In practice Gmail refuses the normal password from SMTP clients, so the fix is:

1. Turn on 2-Step Verification for the Google account. The app password option does not appear without it.
2. Create an app password in your Google account's security settings and copy it.
3. Use it as the SMTP password. The user is your full address, such as you@gmail.com.
4. Store both as secrets on the server, never in page code.

If it worked for months and then stopped, look for a password change on the account: Google's help says app passwords are revoked when you change your Google password. Create a new one.

On a work or school account, Google's page notes that you may not see the app password option at all. Then the organisation's admin decides how apps may sign in.

Check what your code really sends

Before you blame Google, print the length of the user and password your server reads, not the values. An empty or wrong variable produces either this error or “Missing credentials for "PLAIN"”. transporter.verify() connects and logs in without sending anything, so you can test the login on its own.

// Fail at startup with a clear message instead of failing on the first visitor's message.
for (const name of ["SMTP_HOST", "SMTP_PORT", "SMTP_USER", "SMTP_PASS"]) {
  if (!process.env[name]) throw new Error(`${name} is not set`);
}

const transporter = nodemailer.createTransport({
  host: process.env.SMTP_HOST,
  port: Number(process.env.SMTP_PORT),
  secure: Number(process.env.SMTP_PORT) === 465, // true only for 465
  auth: { user: process.env.SMTP_USER, pass: process.env.SMTP_PASS },
});

await transporter.verify(); // connects and logs in, sends nothing

Do you need Gmail SMTP for a contact form?

If the SMTP login exists only so a contact form can email you, you can drop it: a form that posts to Formgong at https://formgong.com/submit has no SMTP host, port or password in your code, and Formgong sends the notification itself. See the HTML guide.