Is my Gmail account hacked if I see 534?

Not necessarily. 534 means Google wants a different sign in method or a browser confirmation; check recent security activity to be sure.

Will the client retry and succeed by itself?

No. 534 is permanent for that login; you have to change the password type or mechanism, or approve the sign in.

SMTP 534: authentication mechanism too weak

534Authentication mechanism is too weakPermanent: retrying will not help

Example

534-5.7.9 Application-specific password required.

What it means

RFC 4954 defines 534 with enhanced code 5.7.9 as "Authentication mechanism is too weak". The server will not accept the SASL mechanism the client used for this account, because policy demands something stronger.

Large providers stretch that meaning. Gmail answers 534-5.7.9 "Application-specific password required" when an account with 2-Step Verification is used with its normal password, and 534-5.7.14 when Google wants the user to sign in through a web browser first, often after a suspicious login. In both cases the account is fine; the way the client signs in is not.

It differs from 535, which says the credentials themselves are wrong, and from 538, which says the mechanism is only allowed over an encrypted connection.

Likely causes

The account has 2-Step Verification on and the client is using the regular account password instead of an app password.
The provider blocked a sign in from an unfamiliar location or app and wants the user to confirm it in a browser.
The server only allows strong mechanisms (such as SCRAM or OAuth) for this account and the client tried PLAIN or LOGIN.
Basic authentication was disabled for the account or tenant and only OAuth logins are accepted.

How to fix it

For Gmail with 5.7.9, create an app password in the Google account security settings and use it in the client, or switch the client to OAuth sign in.
For Gmail with 5.7.14, sign in to the account in a browser from the same network, approve the security prompt, and retry.
For other servers, check the mechanisms they advertise after STARTTLS and pick the strongest one your client supports.
If your provider has retired password logins for SMTP, move the device or script to OAuth or to a relay service built for applications.

Checks that apply

Your domain or sending IP (fills in the checks below)

SMTP Diagnostics Lists the AUTH mechanisms the server offers after STARTTLS, showing whether OAuth or other strong methods are required.

FAQ

Is my Gmail account hacked if I see 534?: Not necessarily. 534 means Google wants a different sign in method or a browser confirmation; check recent security activity to be sure.
Will the client retry and succeed by itself?: No. 534 is permanent for that login; you have to change the password type or mechanism, or approve the sign in.

All 191 bounce codes