Use PHPMailer’s SMTP transport with Gmail’s smtp.gmail.com server. Authenticate with a Google app password when the account permits it, or use OAuth2/XOAUTH2 when app passwords are unavailable or unsuitable. Port 465 uses implicit TLS; port 587 uses STARTTLS.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What you need before writing code
A reliable Gmail-to-PHPMailer setup has four parts: a PHP application, PHPMailer installed through Composer, an authenticated Gmail account, and outbound network access to Gmail’s SMTP service. Decide the authentication method before configuring the message, because the credentials and PHPMailer settings differ.
As an Amazon Associate I earn from qualifying purchases.
- PHP application: Use a supported PHP installation with Composer and TLS support (the OpenSSL extension is normally required for encrypted SMTP).
- PHPMailer: Install the maintained package rather than copying individual library files into the project.
- Gmail account: Use the complete Gmail address as the SMTP username. A consumer account and a Google Workspace account can have different administrator policies.
- Network path: The server must resolve
smtp.gmail.comand permit outbound TCP traffic on the port you select. - Authentication choice: Use an app password for a straightforward password-based integration when policy allows it. Use OAuth2 when the organization blocks app passwords or you need token-based account access.
Install PHPMailer with Composer
From the application directory, run:
composer require phpmailer/phpmailerComposer creates the dependency tree and the autoloader. Load that autoloader before instantiating PHPMailer:
require __DIR__ . '/vendor/autoload.php';Do not commit the vendor directory’s credentials or any local environment file containing mail secrets. The library itself can be committed or installed during deployment, but passwords, OAuth client secrets and refresh tokens must be stored in the deployment secret manager or protected environment variables.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Gmail SMTP settings PHPMailer expects
Gmail’s maintained SMTP examples use the following endpoint and encryption combinations. Encryption and port must match; selecting one from each column independently can produce a failed TLS handshake or authentication error.
| Connection | Host | Port | PHPMailer encryption constant | What happens |
|---|---|---|---|---|
| Implicit TLS (SMTPS) | smtp.gmail.com |
465 | PHPMailer::ENCRYPTION_SMTPS |
TLS starts as soon as the TCP connection is opened. |
| Explicit TLS (STARTTLS) | smtp.gmail.com |
587 | PHPMailer::ENCRYPTION_STARTTLS |
The session begins unencrypted, then upgrades to TLS before authentication. |
Port 465 and port 587 are both supported. Your hosting provider’s firewall policy may allow one and block the other, so test the port you intend to deploy rather than assuming both are reachable. Do not set port 465 with ENCRYPTION_STARTTLS, or port 587 with ENCRYPTION_SMTPS; the transport negotiation must agree with Gmail’s endpoint.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchChanging ports addresses a transport problem only. It does not repair an invalid app password, a revoked OAuth token, a disabled account, or a sender address that Gmail does not authorize.
Option 1: authenticate with a Gmail app password
When this method is appropriate
Google describes an app password as a 16-digit passcode for apps or devices that cannot use “Sign in with Google.” It requires 2-Step Verification on the account. The normal Gmail account password is not the credential for this PHPMailer workflow.
App passwords can be unavailable when a work or school administrator has disabled them, when the account is enrolled in Advanced Protection, or when another account policy restricts them. Changing the main Google Account password revokes existing app passwords, so a password rotation can stop mail delivery until a new one is issued.
Create the credential
- Sign in to the Gmail account in the Google Account security settings.
- Enable 2-Step Verification if it is not already enabled.
- Open App passwords, create a credential for the mail application, and copy the displayed 16-digit value. Google may show the value only once.
- Store it in a protected environment variable such as
GMAIL_APP_PASSWORD. Do not paste it into a public repository, a browser-delivered configuration file, or an error page.
Label the secret by environment so a test credential is not accidentally promoted to production. Limit access to the process that sends mail, and remove old values after a deliberate rotation. If delivery stops immediately after an account-password change, check for this automatic app-password revocation before rewriting the PHPMailer code.
Recommended Free Tools
Minimal password-based configuration
This example uses implicit TLS on port 465 and reads the secret at runtime:
<?php
use PHPMailerPHPMailerPHPMailer;
use PHPMailerPHPMailerSMTP;
require __DIR__ . '/vendor/autoload.php';
$mail = new PHPMailer(true);
$mail->isSMTP();
$mail->Host = 'smtp.gmail.com';
$mail->SMTPAuth = true;
$mail->Username = '[email protected]';
$mail->Password = getenv('GMAIL_APP_PASSWORD');
$mail->Port = 465;
$mail->SMTPSecure = PHPMailer::ENCRYPTION_SMTPS;
$mail->setFrom('[email protected]', 'Your Name');
$mail->addAddress('[email protected]');
$mail->Subject = 'Test message';
$mail->Body = 'Hello from PHPMailer';
$mail->send();For STARTTLS, change the port to 587 and set $mail->SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS;. Leave SMTPAuth enabled and keep the complete Gmail address in Username.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Wrap sending in exception handling in a real application so a failed delivery is logged without exposing the app password or the SMTP transcript to the recipient:
try {
$mail->send();
} catch (Throwable $e) {
error_log('Mail send failed: ' . $e->getMessage());
}Log a correlation ID and the failure category rather than dumping credentials. PHPMailer’s exception text is useful during development, but production logs should be access-controlled.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Set the sender and reply address safely
Gmail expects the From address to be the authenticated account or an alias already configured for that account. Setting an arbitrary visitor’s address as From can trigger rejection, sender rewriting, or delivery problems.
For a contact form, keep the Gmail account as the sender and put the visitor’s address in Reply-To:
$mail->setFrom('[email protected]', 'Website mailer');
$mail->addReplyTo($visitorEmail, $visitorName);Validate and normalize visitor input before calling addReplyTo. Never concatenate untrusted text into raw SMTP commands. Add each recipient with addAddress; use addCC or addBCC only when those recipients genuinely need the message.
If you configure an alias in Gmail, verify that the account is permitted to send as that alias before deploying it. A valid SMTP login does not automatically authorize every address in the organization. Keep the visible sender consistent across templates so recipients and mail administrators can identify the application.
Option 2: use OAuth2/XOAuth2
Why choose OAuth2
Gmail SMTP supports OAuth 2.0. OAuth2 avoids placing a reusable account password in the application and is the better fit when an administrator disallows app passwords, when security policy requires token-based access, or when a managed deployment needs centrally controlled consent and revocation.
The trade-off is operational complexity: the application must obtain consent, retain a refresh token securely, refresh access tokens, and keep its OAuth client configuration valid. Treat the client secret and refresh token as production credentials. Request only the scopes needed to send mail.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
PHPMailer integration points
PHPMailer’s maintained gmail_xoauth.phps example uses the League OAuth2 client integration. The essential PHPMailer changes are:
$mail->isSMTP();
$mail->Host = 'smtp.gmail.com';
$mail->SMTPAuth = true;
$mail->AuthType = 'XOAUTH2';
$mail->Username = '[email protected]';
$mail->setOAuth($oauthProvider);The provider object must supply the OAuth client ID, client secret, refresh token and token endpoint through the integration shown in PHPMailer’s example. Install the OAuth-related Composer dependencies and support files required by that example rather than guessing class names or token fields.
Free tools Windows power users keep installed
One-click scans. No signup required.
Register the redirect URI exactly as required by your OAuth client configuration, complete consent once for the sending account, and persist the resulting refresh token in a secret store. An inaccurate server clock can invalidate token assertions, so keep the PHP and operating-system time synchronized. When diagnosing XOAUTH2 failures, check consent status, client ID and secret, redirect configuration, token storage, scope, and server time before changing SMTP ports.
App password or OAuth2?
| Decision factor | App password | OAuth2/XOAUTH2 |
|---|---|---|
| Account policy | Works only when 2-Step Verification is enabled and app passwords are allowed. | Works with Gmail SMTP when the organization requires token-based authorization or blocks app passwords. |
| Initial setup | Create a 16-digit credential and place it in the password field. | Register a client, obtain consent, configure a provider, and persist a refresh token. |
| Secret lifecycle | Changing the main Google password revokes existing app passwords; issue a replacement. | Protect and rotate client secrets and refresh tokens; revoke and re-authorize compromised tokens. |
| Managed environments | Simple for one approved account but subject to administrator controls. | Better suited to centralized consent, revocation and organization-wide security requirements. |
Both methods still use the same Gmail host, TLS choices, complete username and authorized From address. Authentication choice does not remove the need to test DNS, TCP connectivity and sender policy.
Build a complete message
After SMTP authentication succeeds, construct the message separately from transport configuration. A plain-text message is the safest first test:
$mail->Subject = 'Account notification';
$mail->Body = "The operation completed successfully.";
$mail->AltBody = "The operation completed successfully.";For HTML mail, call isHTML(true) and always provide a readable AltBody fallback:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute$mail->isHTML(true);
$mail->Subject = 'Account notification';
$mail->Body = '<p>The operation completed successfully.</p>';
$mail->AltBody = 'The operation completed successfully.';Escape user-supplied values before inserting them into HTML, limit attachment size, and use a stable subject and sender identity. PHPMailer handles MIME construction; it does not make untrusted HTML safe automatically.
Test the connection before blaming authentication
- Confirm DNS resolution for
smtp.gmail.comfrom the same server that runs PHP. - Check that outbound TCP traffic to port 465 or 587 is permitted by the host, cloud security group and local firewall.
- Verify that the selected PHPMailer encryption constant matches the port.
- Run a plain-text test to a mailbox you control before adding templates, attachments or form input.
- Confirm that the sender is the authenticated Gmail address or a configured alias.
During diagnosis, enable server-level SMTP debugging:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
use PHPMailerPHPMailerSMTP;
$mail->SMTPDebug = SMTP::DEBUG_SERVER;Capture the transcript only in a protected development log. It can contain hostnames, response codes and account identifiers. Set SMTPDebug back to 0 in production and never show the transcript in an HTTP response.
A useful rollout sequence is to test the network without application input, send one plain-text message, verify the authenticated sender, then add HTML, attachments and reply handling one feature at a time. This isolates transport failures from message-construction bugs and makes the first SMTP transcript easier to interpret.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Interpret common Gmail and PHPMailer failures
| Symptom or code | Likely cause | What to check |
|---|---|---|
| 535 authentication failed | Username or credential rejected. | Use the complete Gmail address, verify that 2-Step Verification is enabled for an app-password flow, generate a fresh app password, and ensure the ordinary account password was not used. For OAuth2, verify the refresh token and consent. |
| 534 application-specific password required | Gmail expects an app password for this sign-in path. | Create an app password after enabling 2-Step Verification, unless an administrator or account protection policy prevents that method; otherwise move to OAuth2. |
| 504 authentication type unsupported | The server and client disagree about the authentication mechanism. | Check that PHPMailer is using normal authenticated SMTP for an app password or XOAUTH2 for OAuth2, and that the library and OAuth dependencies are complete. |
| TLS handshake or connection timeout | Port/encryption mismatch, blocked outbound traffic, DNS failure or certificate problem. | Match 465 with implicit SMTPS or 587 with STARTTLS, test DNS and firewall rules, and inspect the debug transcript. |
| Message accepted but sender rejected or rewritten | The From address is not the authenticated account or a configured alias. |
Use the authenticated address in setFrom; put the visitor’s address in addReplyTo. |
| OAuth2 token errors | Invalid consent, client settings, refresh token, scope or server time. | Recheck the registered redirect URI, token storage, client credentials, requested scope and PHP timezone/clock synchronization. |
A port change cannot fix an invalid credential, and generating a new app password cannot fix a blocked firewall. Identify which layer failed—DNS, TCP, TLS, authentication or sender policy—using the debug transcript.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Gmail and Google Workspace sending limits
Google Workspace Admin Help documents the Gmail SMTP option at smtp.gmail.com with SSL on port 465 and TLS on port 587. It lists a 2,000-message-per-day sending limit for that option. Treat this as an operational Workspace limit, not a promise of unlimited throughput; administrators and Google’s current sending policies can impose additional restrictions.
Direct Gmail SMTP is appropriate for low-volume application notifications when one account or a small set of configured aliases owns the sender identity. It is less suitable when an organization needs centralized routing, several applications, many senders, or higher and more predictable volume.
| Approach | Administration | Sender control | Volume and policy considerations | Best fit |
|---|---|---|---|---|
| Direct Gmail SMTP | Each application authenticates to a Gmail account. | Uses that account or its configured aliases. | Subject to account authentication rules and the documented 2,000-message-per-day Workspace SMTP limit. | Small applications and transactional notifications owned by one account. |
| Workspace SMTP relay | Configured and governed by Workspace administrators. | Can centralize permitted applications, IPs and sender policies. | Uses organization-level controls and Google’s current relay and sending policies. | Managed deployments, multiple applications or centralized mail operations. |
Before production launch, have the Workspace administrator confirm whether direct SMTP or relay is permitted, which senders are authorized, and what rate controls apply. Do not design around the 2,000-message figure if the application’s volume or sender count is expected to grow.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Relay is an administration decision, not simply a different hostname to substitute in the PHP code. The administrator may require approved source IPs, sender restrictions or organization-wide routing. Document those controls alongside the application’s secret and deployment settings so a future infrastructure change does not silently break delivery.
Production hardening checklist
- Keep app passwords, OAuth client secrets and refresh tokens outside source control.
- Use a dedicated sending account or approved alias rather than a developer’s personal mailbox.
- Use
setFromfor the authenticated identity andaddReplyTofor user responses. - Choose one tested pair: port 465 with
ENCRYPTION_SMTPS, or port 587 withENCRYPTION_STARTTLS. - Turn off
SMTPDebugafter troubleshooting and protect all error logs. - Monitor authentication failures, connection timeouts, rejected senders and rate-limit responses without logging secrets.
- Plan credential rotation: changing a Google Account password revokes its app passwords, while OAuth2 refresh tokens must be revoked and reissued when compromised.
- Ask a Workspace administrator to review relay and sending policies before moving beyond low-volume notifications.
A practical decision rule
Choose an app password when 2-Step Verification is enabled, the account policy exposes app passwords, and a simple single-account integration meets your operational needs. Choose OAuth2 when app passwords are hidden or prohibited, when token-based access is required, or when your security team needs consent and revocation controls. Regardless of authentication method, Gmail SMTP still requires the correct host, matching TLS mode, a complete username, and an authorized sender address.
Frequently Asked Questions
What are Gmail’s SMTP host, port and encryption settings for PHPMailer?
Use smtp.gmail.com. Pair port 465 with PHPMailer::ENCRYPTION_SMTPS for implicit TLS, or pair port 587 with PHPMailer::ENCRYPTION_STARTTLS for explicit STARTTLS.
Can I use my normal Gmail password in PHPMailer?
No. For password authentication, enable 2-Step Verification and create a Google app password. The app password is a 16-digit credential; the ordinary account password is not the correct SMTP credential for this setup.
Why is the App passwords option missing?
A work or school administrator may have disabled app passwords, Advanced Protection may restrict them, or another account policy may hide them. Use OAuth2/XOAUTH2 when policy does not permit app passwords.
Should the visitor’s email address be the From address?
No. Set the authenticated Gmail account or a configured Gmail alias as From, and put the visitor’s address in addReplyTo. This avoids sender-policy rejection or rewriting.
When should I choose OAuth2 instead of an app password?
Choose OAuth2 when app passwords are prohibited or unavailable, when security policy requires token-based access, or when a managed deployment needs consent and revocation controls. It requires a client configuration, consent, a securely stored refresh token and token refresh handling.
What does a Gmail 535 error mean?
A 535 response commonly means Gmail rejected the username or credential. Check that the username is the complete Gmail address, that you generated a fresh app password rather than using the normal password, or that the OAuth consent and refresh token are valid.
What does a 534 application-specific password error mean?
Gmail expects an app password for the sign-in path. Enable 2-Step Verification and create one if account policy allows it; otherwise configure OAuth2.
How do I troubleshoot a TLS timeout?
Verify DNS resolution for smtp.gmail.com, check outbound firewall and security-group rules, and ensure the encryption constant matches the port: implicit SMTPS on 465 or STARTTLS on 587. Enable SMTP::DEBUG_SERVER temporarily in a protected development log, then disable it.
How many messages can I send through Workspace Gmail SMTP?
Google Workspace Admin Help lists a 2,000-message-per-day limit for the Gmail SMTP option. Organizations with higher volume, multiple applications or centralized controls should have an administrator evaluate Workspace SMTP relay and current sending policies.
The Bottom Line
Install PHPMailer with Composer, connect to smtp.gmail.com, and match port 465/implicit SMTPS or port 587/STARTTLS. Use a 16-digit app password when account policy permits it; otherwise configure OAuth2/XOAUTH2 with protected client credentials and refresh tokens. Keep the authenticated account or approved alias in From, place user addresses in Reply-To, disable SMTP debugging in production, and confirm Workspace limits before scaling.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
