Windows VPN Error 691: Authentication Fixes

Error 691 is the one Windows VPN error that is genuinely about you. Windows tells you that access was denied because the username or password is not valid. The connection did reach the server, which is the good news, and then the server said no.

The surprising part is how often 691 appears when the password is, as far as the user can tell, correct. This article is about that gap. It looks at the small, easy-to-miss ways a correct-looking sign-in fails, shows you which login a prepaid pass actually uses, and walks through a clean re-entry that removes most causes at once. If you want the overview that places 691 next to 809 and 789, see common Windows VPN errors; here we stay on windows vpn error 691.

What 691 proves, and what it does not

First, a short reading of the message. Windows reports that access was denied because the username and/or password is invalid on the domain. In practice that wording covers more than a wrong password.

• It proves the server was reached. Networks, routers and firewalls are not the issue, which separates 691 from error 809. You do not need to test hotspots or restart the router.
• It proves a sign-in was attempted. Something was sent to the server as a username and password. Whether it was what you meant to send is the question.
• It does not prove the stored password is wrong. A correct password sent with a hidden space, in the wrong form or with the wrong settings still fails.
• It does not name the reason. The server answers only that it refused. A good server does not reveal whether the username or the password was the wrong half.

That last point has a security reason: telling a stranger which half was wrong would help them guess. It means you have to check both halves yourself.

Which login does the VPN use?

This is the most common cause among prepaid customers, so it comes first. There are three separate logins around a pass, and they are easy to confuse.

Login	Where you use it	Is it the VPN login?
Email and one-time sign-in link	The XPASS website, to open your account	No
Card and order details	Checkout	No
VPN username and password	The VPN connection or app	Yes. Shown on your My Pass page

The VPN login appears only on My Pass, after you sign in to the website. For security it is never emailed. If you have lost track of it, where to find your login details explains how to reach it. If you type your email address as the VPN username, or the password you chose for another service, the server cannot match it and returns 691 every time.

Also check that your pass is delivered and still active on My Pass. A pass that has expired is no longer accepted by the server, and the failure looks exactly like a wrong password. Expiry is shown in UTC, which may be a few hours different from your local time. If it has lapsed, renewing the pass adds the new days on top of any remaining time. Use the details shown on My Pass after renewing.

Six ways a correct password still fails

Once you are sure you are using the right login, look for these. They explain most "but I typed it right" stories.

Cause	What happened	Example	Fix
Keyboard language	The input method was set to another language	A Thai layout typed ฟ instead of a, so the password looks right on screen but is different	Switch to English before typing, or paste instead
Caps Lock or a stuck key	Case changed	Pass7k sent as pASS7K	Look at the keyboard light; paste instead
Hidden space	Copying picked up a space at the start or end	A password pasted from a chat app with a trailing space	Re-copy from My Pass and select only the text
Look-alike characters	Two characters look the same	Capital O versus zero, lowercase l versus capital I	Copy, do not retype
Smart punctuation	A chat or word-processing tool changed a character	A straight apostrophe turned curly	Copy directly from My Pass
Stale saved credentials	Windows remembers an older entry	You changed or renewed but the old one is cached	Delete the entry and add it again

The keyboard language case deserves its own comment for Thai users, because it is so easy to miss. A password typed while the Thai layout is active produces Thai characters, which can look odd in a masked field you cannot read. If the password field shows dots, you have no way to see this. Check the language indicator in the taskbar, switch to English with the key shortcut your PC uses, and retype. Better still, avoid retyping and paste.

Re-enter the details cleanly: a step-by-step

Instead of tweaking one field after another, reset the whole entry once. This removes hidden spaces, stale values and layout mistakes in a single pass.

1. Open My Pass in your browser and show the VPN details.
2. Copy the username. Use the copy button if there is one. If you select by hand, select only the characters and nothing around them.
3. Check it in Notepad. Paste it into a blank Notepad window. Look for a gap before or after the text, press End to see where the cursor sits, and compare with the page. Close without saving.
4. Open Settings > Network & internet > VPN, select your connection, then choose Advanced options > Edit.
5. Paste the username into the user name field, then paste the password the same way.
6. Save and connect. If Windows asks for a sign-in again, paste again rather than typing.
7. If it still fails, delete the VPN entry with Remove, add it again from scratch and paste both values into the new entry. This clears any saved credentials tied to the old one.

This procedure takes a couple of minutes and settles the great majority of 691 cases. If you have not yet created an entry, the Windows setup guide shows the whole process.

Sign-in type and the options that change what is sent

Windows has a few settings that quietly alter what goes to the server. Check them in the same Advanced options > Edit screen.

• Type of sign-in info. This should be User name and password for a normal prepaid pass. If it is set to something else, such as a certificate or a one-time password, the server never receives what it expects.
• Remember my sign-in info. If ticked, Windows may reuse an older saved value. Untick it for one test, connect, enter the details fresh and tick it again if you want.
• Use Windows sign-in name and password. Some company profiles send your Windows account name automatically. For a personal pass this is wrong. Make sure the connection uses the VPN details, not your Windows account.
• Include Windows logon domain. This adds a domain in front of the username, which suits company networks. For a pass username, leave it off.
• VPN type. An incorrect type can make authentication fail in odd ways. If your account page names a method, use it; otherwise leave it on Automatic.

Some Windows builds also offer older, classic network properties windows that expose authentication options such as the type of password protocol. Changing these without a reason can break a working connection. Unless your account page names a specific setting, keep the defaults.

Account-side reasons: expiry, delivery and repeated failures

When the details are clean and the settings are right, the cause may be on the account side.

• Not yet delivered. After payment, the VPN account is created automatically. If the order page still shows pending, the details do not work yet. Wait a few minutes and refresh My Pass.
• Expired pass. Validity starts when the account is created, not when you first connect. If the days have run out, the server refuses the sign-in.
• Old details saved in Windows. If you set up an earlier pass, the saved entry may still hold its details. Use what My Pass shows now and remove old entries.
• Temporary refusals after many wrong attempts. Some servers briefly slow down or refuse repeated failures. If you have tried many times in a row, stop for a few minutes before the next clean attempt, so you do not keep triggering it.

These do not need network tests. Look at My Pass, confirm status and expiry, and use the details exactly as shown.

Protecting the password while you troubleshoot

Troubleshooting a sign-in invites habits that put credentials at risk. A few rules keep it safe.

1. Paste, do not photograph. A screenshot of the password lives in your photo library and may sync to places you do not expect.
2. Clear the scratch space. If you paste into Notepad to check, close it without saving.
3. Never send the password to anyone. That includes support. They can see your order without it.
4. Avoid reusing the password elsewhere. Guidance such as NIST SP 800-63B favours unique secrets and allows pasting, which is why pasting is the right habit here.
5. Protect the account that holds it. Your website sign-in is the door to My Pass, so see CISA's advice on multi-factor authentication for your email account.

If you use the free VPNclient app instead of the built-in Windows client, the same rule applies: sign in with the username and password from My Pass, not the website email. The download page lists the official links.

When to contact support, and what to send

Write to support when the pass shows as active, you re-entered both values by pasting, you removed and recreated the entry, and 691 still appears. Email xpassvpn@gmail.com with the error number, your Windows version, the connection type, the time of the last attempt, and the email used at checkout. State that you pasted the details from My Pass and recreated the entry, so support can skip the basic steps. Never include the password.

Summary

Error 691 means the server heard you and refused the sign-in, so the network is fine and the details are the focus. Make sure you are using the VPN login from My Pass, confirm the pass is delivered and active, then delete the Windows entry and rebuild it by pasting both values. Check the keyboard language, hidden spaces, look-alike characters and the sign-in type setting, and keep the password to yourself throughout. If the pass has run out, you can renew it from the pricing page.