VPN Authentication Failed: Fix Login Errors

You tap connect, the spinner turns for a second or two, and then the app answers with something like "authentication failed", "invalid credentials" or "login error". It feels like a dead end, but this particular error is one of the most useful messages a VPN app can give you. It says that your device reached the VPN server, which means your internet connection and the route to the server are working. The only thing that went wrong is the step where the server decides whether it accepts you.

This article is about that single moment. It explains what the server checks, the seven usual reasons it says no, how to tell them apart by the details of the message, and a short order of operations that fixes most cases in under ten minutes. If your problem is instead that the app never gets an answer at all, read VPN not connecting? Step-by-step fixes first, because a timeout and an authentication failure need different cures.

What "authentication failed" really tells you

Every VPN connection has two phases that matter here. First, the app and the server open a channel and agree how to protect it. Second, the server asks who you are. The first phase is the network and cryptography part, the second is the identity part. The identity part can use a username and password, a certificate, a pre-shared key, a token, or a combination of these. "Authentication failed" means the second phase ended with a refusal.

That has a useful consequence. Because the server answered, you can stop suspecting your Wi-Fi, your router and your internet provider. You can also stop trying other server locations in the hope that one will "work", because every location checks the same account. Changing location only helps if the problem is something specific to one server, which is rare and usually shows up as a different message.

Standards documents describe the same split. In IKEv2, for example, the exchange first establishes keys and then authenticates each side, and a failure in the second step is reported separately from a failure to reach the peer. Modern TLS-based tunnels do the same with certificates before any user check. You do not need to read the specifications to fix the error, but they explain why the message wording matters.

Here is how to read the common wordings.

What the app says	What it usually means	Where to look first
Invalid username or password	The pair was refused	Typing, copy-paste, wrong credential type
Account expired / no active plan	The server knows you, but access has ended	Pass validity and renewal
Certificate or identity error	The app does not trust the server, or the server does not trust the app	Device date and time, outdated app
Too many attempts / account locked	The server paused your account after repeated failures	Wait, then retry carefully
Generic "login failed" with no detail	Any of the above	Work through the checklist below

The seven usual causes

Cause 1: the wrong kind of password

The most common reason is simple and a little unfair: people type the right password into the wrong place. Many VPN services keep two separate sets of details. One set signs you in to the website or the customer area. The other set signs the app in to the tunnel. They can even be unrelated in shape, with one being an email address and the other a short generated name.

With XPASS the rule is clear. The free VPNclient app asks for the VPN username and password that appear on your My Pass page. It does not accept the email address you used at checkout, and it does not use the one-time sign-in link that opens My Pass. If you try your email, the app will say authentication failed, and it will be correct to say so. If you cannot remember where to find the details, where are my VPN login details shows the page and explains why the details are never sent by email.

Check yourself against this list:

1. Are you typing the website email into the app? Replace it with the VPN username.
2. Are you using a password you chose yourself? The VPN password may have been generated for you.
3. Did you reset or regenerate anything on the account since you last signed in to the app? Then the saved details in the app are stale.

Cause 2: typing and copying errors

Generated passwords are built to be hard to guess, and that makes them easy to mistype. The usual culprits are characters that look alike: the capital letter I and the lowercase l, the digit 0 and the letter O, and the digit 1 in a font that makes it look like a lowercase L. On a phone keyboard, autocorrect and autocapitalisation add two more problems. The first letter of the username may be capitalised without you noticing, and a space may be added after a pasted word by the keyboard.

How to rule this out in a few steps:

1. Open My Pass on a larger screen if you can, such as a laptop, and read the details slowly.
2. Use copy and paste instead of retyping. Copy the username, paste it, then copy the password and paste that.
3. After pasting, delete any trailing space. Many keyboards and note apps add one.
4. Tap the "show password" icon in the app if it offers one, and compare character by character.
5. If you are on a television or a console with a remote, type slowly and check each field before you confirm. Remote keyboards often drop or repeat letters.

This is also a good point to stop and wait. If two attempts failed, a third identical attempt will fail the same way and might trigger a temporary pause. Fix the input first.

Cause 3: the pass has ended or is not active yet

Prepaid access has a start and an end. With XPASS, validity starts when the VPN account is created at delivery, not when you first connect, and the pass ends on its own when the days run out. After that, the server still knows the username but no longer accepts it, which usually appears as authentication failed or as an "account expired" style message.

Ask yourself three questions:

• When did I buy the pass, and how many days did it include? Count forward from delivery.
• Does the My Pass page still show the pass as active, and how many days remain?
• Did I buy a new pass recently? A freshly delivered pass can take a few minutes to appear, and the order page shows the status.

If the pass has ended, the cure is to renew. Renewing adds the new days on top of any remaining days, so renewing a little early costs you nothing in lost time. The guide on how your VPN pass expires shows how to check the end date, and how to renew your VPN pass walks through the payment.

Cause 4: wrong date, time or time zone on the device

This one surprises people because the password is correct. Encrypted connections rely on certificates, and a certificate is only valid between two dates. If your phone or computer believes it is a different day than it really is, even by a few minutes in some setups, the app may decide that the server's certificate is not yet valid or already expired. Some one-time codes also depend on synchronised clocks, which is why time-based codes in two-factor systems fail when a clock drifts.

You see this mostly in four situations: a phone that has been switched off for weeks and restarted, a laptop whose battery died and lost its clock, a device with the date set by hand to test something, and a trip across time zones with automatic time switched off.

The fix takes under a minute:

1. Open the date and time settings.
2. Turn on automatic date and time, and automatic time zone.
3. Wait a few seconds for the clock to update, or toggle the setting off and on.
4. Reopen the VPN app and try again.

If you want to understand why time matters for digital identity checks, NIST's digital identity guidelines discuss time-based and one-time authenticators and why they depend on accurate clocks. You can also read how two-factor authentication uses time in practice.

Cause 5: a stale session or saved details

Apps remember what you typed last. That is convenient until something changes. If you updated your details, were given new ones, or pasted a wrong value once and the app saved it, the app will keep sending the old pair and you will keep getting the same error. The screen looks identical every time, so it is easy to believe you are retrying when you are really repeating the same mistake.

To clear it:

1. Sign out inside the app, if it offers a sign-out or reset option.
2. Close the app fully, not only to the background.
3. Reopen it and enter the details fresh, pasting from My Pass.
4. If the app still holds the old pair, remove the saved connection or profile and add it again.
5. As a last step, uninstall and reinstall the app from the official store link on the download page, then sign in once.

Do this in order. Reinstalling first throws away information that you might have used to learn what changed.

Cause 6: too many failed attempts

Services protect accounts against guessing. After several wrong tries in a short time, the server may refuse all attempts for a while, including correct ones. From your side this looks cruel: you finally type the right password and it is still refused. The pause usually lifts by itself after a few minutes to an hour, depending on the service.

What helps:

• Stop retrying. Every extra attempt may extend the pause.
• Wait at least fifteen minutes, then try once with details pasted from My Pass.
• If you are on a shared connection, such as a hotel or a campus network, other people's failed attempts can look like yours when the network presents one address to the outside. Switching to mobile data for a single attempt can show whether that is happening.
• If it is still refused after an hour with details you are sure are correct, contact support with the time of your attempts and what the app said.

Cause 7: the app is too old or the profile is damaged

Apps change how they talk to servers. An app that has not been updated for a long time may use a method the server no longer accepts, and a profile imported long ago may point to something that has changed. The signs are an error that started on a particular day without any change by you, and the fact that a different device with a newer app connects normally.

A quick comparison test helps more than any setting. If you have a second device, install the current app there and sign in with the same details. If the second device connects, your account is fine and the first device needs an update or a clean reinstall. If both fail, the problem is the account, the credentials or the pass.

Also check the operating system. A major system update can reset the permission that lets a VPN app create its connection. On Android, the system asks you to allow a VPN connection; on iPhone and iPad, a profile is added; on Windows and macOS a system prompt can appear. If the app seems to start but the system shows no VPN icon, review the permission before blaming your password. The device guides for Android and iPhone and iPad list what to check on each platform.

A ten-minute order of operations

If you do not want to read every cause, run this sequence. It is ordered from cheapest and most likely to most disruptive.

1. Read the message. Note the exact wording and the time. Photograph it if it is long.
2. Open My Pass. Confirm the pass is active and see the VPN username and password.
3. Paste, do not type. Copy both values and paste them into the app. Remove trailing spaces.
4. Try once. One clean attempt only.
5. Check date and time. Set both to automatic.
6. Wait fifteen minutes if you have already failed three or more times.
7. Sign out, close the app and sign in again.
8. Test on another device or another network, such as mobile data, to separate the account from the device.
9. Update or reinstall the app from the official source.
10. Contact support with the time, device, app version and exact message.

Notice what this list leaves out: changing server locations, restarting the router and flushing DNS. Those are right for other errors, and they waste time here.

Mistakes that keep the error alive

• Typing the website email instead of the VPN username.
• Adding a space when pasting, especially from a notes app.
• Retrying ten times in a row and triggering a pause.
• Trying several locations as if the server were at fault.
• Assuming the pass is active without opening My Pass.
• Using an old screenshot of the details after something changed.
• Sharing a screenshot of the details with a friend or in a support chat in public. Treat the username and password like any other password.

Safety notes when you troubleshoot

Never paste your VPN password into a website that offers to "check" it. Support staff do not need your password to help; they can see the account side. Keep the details out of screenshots that go into group chats. If you believe someone else saw them, ask support what your options are. And if a message that claims to be from your VPN asks you to "verify your login" through a link, treat it as a phishing attempt and open My Pass yourself from the official site. The CISA guidance on recognising phishing lists the signs, and our own piece on recognising phishing websites covers what to look for.

Summary

Authentication failed means the server was reached and refused your identity, so you can set the network aside and work on credentials. In rough order of likelihood, check the type of password you used, typing and pasting errors, whether the pass is still active, the device clock, saved stale details, repeated failed attempts, and an outdated app. Open My Pass, paste instead of typing, try once, and change one thing at a time.

If you need a fresh pass or more days, you can look at the pricing page whenever it suits you.