Creating an app password for Gmail

Two minutes at myaccount.google.com/apppasswords, and you only do it once.

Nevermore signs in to Gmail over IMAP with an app password: a separate, revocable password that works for one app and nothing else. Your ordinary account password will not work, and that is deliberate — there is no OAuth consent screen and no third party in the middle. This is the same for a Google Workspace account on your own domain — choose Gmail as the provider in Nevermore.

Creating one

Turn on 2-Step Verification for your Google Account, if it isn't already. Google does not offer app passwords at all until it is on, and the page below will simply say they are unavailable. This is the step people miss.
Open myaccount.google.com/apppasswords and sign in.
Give the password a name you will recognise later — Nevermore does nicely — and create it.
Google shows you a 16-character password. Copy it.

On a Google Workspace account, an administrator can switch app passwords off for the whole organisation. If the page tells you app passwords aren't available and 2-Step Verification is on, that is usually why, and only your administrator can change it.

Google's own instructions →

Then, in Nevermore

Paste it into the App password field on Nevermore's sign-in screen. Spaces are fine — the app strips them. It goes straight into the macOS Keychain, is never written to disk in the clear, and never leaves your Mac.

An app password is a credential: it grants access to your mailbox. Put it in Nevermore's password field, and nowhere else — not into a note, an email to yourself, or a chat window. If you ever want to cut Nevermore off, delete the app password at your provider; nothing else about your account changes.

If sign-in still fails

Check you entered the app password, not your normal account password. Providers reject both with the same error, so the message looks identical.
Most providers show the password only once and cannot show it again. If you did not copy it, delete that one and create another — they are free and disposable.
If you deleted the password at your provider, or changed something about the account, create a new one and re-enter it.
Still stuck? Get in touch — include your provider and what the error said.

Checked against Google's own instructions on 22 August 2026. Providers move these settings without warning; if what you see does not match, their page is the authoritative one and we would be glad to hear about it.