Why LSA Access Is Being Removed
The shift away from Less Secure Apps is part of Google’s broader security initiative to protect user accounts from unauthorized access. LSA allowed applications to authenticate using basic credentials without modern security protocols, making it easier for attackers to intercept login information through brute-force attacks or phishing schemes. By removing this option, Google forces users to adopt more robust authentication methods that include multi-factor verification or token-based authorization.
If you are currently using an older email client or a custom script to pull emails via IMAP or POP3, you will likely encounter authentication errors once the transition occurs. These errors typically manifest as SASL authentication failed messages or simple connection timeouts when the client attempts to log in with plain text credentials. Understanding the timeline and scope of this change is critical for anyone managing multiple email accounts or automated mail retrieval systems.
Impact on IMAP and POP Users
IMAP and POP protocols are widely used by desktop clients like Thunderbird, Outlook, and mobile apps to sync or download emails. When LSA is disabled, any account configured to use "Less Secure Apps" will lose its ability to connect. This does not affect webmail access or official Google apps, but third-party integrations often fail silently until users notice missing emails or sync failures.
For users who aggregate multiple Gmail accounts into a single inbox, the disruption can be significant. For example, if you use a tool to read all mail on IMAP Gmail with Alpine or Pine, that workflow may break entirely if the source account disables LSA. Similarly, backup solutions that rely on periodic POP downloads could stop functioning, leaving your archives incomplete. It is essential to audit every connected service and update their authentication settings proactively.
How to Fix Authentication Issues
The primary solution is to enable App Passwords if you have two-step verification turned on. App Passwords generate a 16-character code specifically for less secure devices, bypassing the need for LSA while maintaining security. If you do not have two-step verification enabled, you must activate it first before generating these passwords. This method is supported by most modern email clients and requires minimal configuration changes.
Alternatively, migrating to OAuth2 authentication is the long-term fix. Most updated versions of popular email clients now support OAuth2 natively. You simply need to re-authenticate your account through the client’s interface, which redirects you to Google’s secure login page. Once authorized, the client receives an access token that remains valid until revoked. This process eliminates the need for storing plaintext passwords in your email application.
Step-by-Step Guide to Enabling App Passwords
- Sign in to your Google Account at
myaccount.google.com. - Navigate to Security settings and ensure Two-Step Verification is active.
- Select App Passwords from the list of security options.
- Choose Mail as the app and your device type from the dropdown menu.
- Click Generate to create a 16-character password.
- Copy this password and enter it into your email client’s settings in place of your regular password.
Alternatives and Best Practices
If your email client does not support App Passwords or OAuth2, consider switching to a more modern alternative. Many users find that tools like Thunderbird offer robust backup capabilities and safety features when configured correctly. Using such clients ensures that your data remains accessible even as Google tightens its security policies. Always verify that your chosen software supports current authentication standards before committing to it.
Another consideration is whether you truly need IMAP or POP. For many users, accessing mail directly through the web interface or official mobile apps provides a seamless experience without technical hurdles. However, for those who require offline access or advanced filtering, configuring proper authentication remains necessary. Regularly reviewing connected apps and services under the Security tab helps identify any legacy connections that may still be using deprecated methods.
Frequently Asked Questions
Will my existing emails be deleted when LSA is disabled?
No, disabling Less Secure Apps does not delete any of your existing emails or data. It only prevents new connections from being established using old authentication methods. Your mailbox content remains intact and accessible via webmail or properly authenticated clients.
Can I keep using my old password after LSA is removed?
No, standard passwords will no longer work for IMAP or POP connections once LSA is fully disabled. You must either use an App Password or switch to OAuth2 authentication. Continuing to use your main password will result in persistent login failures.
Does this change affect Google Workspace accounts?
Yes, Google Workspace administrators can enforce policies that restrict LSA usage across all organizational accounts. Even if individual users try to enable it, admin settings may block the feature. Check with your IT department to ensure compliance with organizational security standards.
How do I know if my email client supports OAuth2?
Most recent versions of major email clients like Microsoft Outlook, Apple Mail, and Mozilla Thunderbird support OAuth2. Look for options labeled "OAuth," "Modern Authentication," or "Sign in with Google" in the account setup wizard. If unsure, consult the client’s help documentation or update to the latest version.
What happens if I don’t update my settings before the deadline?
Your email client will fail to send or receive new messages. You may see error messages indicating authentication failure. Until you update the authentication method, your email sync will remain broken, potentially causing missed communications.