AlistGo/alist · warning · WrongPassword

password is incorrect

Error message

password is incorrect

What it means

WrongPassword ('password is incorrect') is a sentinel in internal/errs/user.go returned when a login attempt supplies a username that exists but a password whose hash does not match the stored one. It is the standard authentication-failure signal for the local user store.

Source

Thrown at internal/errs/user.go:8

package errs

import "errors"

var (
	EmptyUsername      = errors.New("username is empty")
	EmptyPassword      = errors.New("password is empty")
	WrongPassword      = errors.New("password is incorrect")
	DeleteAdminOrGuest = errors.New("cannot delete admin or guest")
)

View on GitHub (pinned to 843d9dc814)

Solutions

1. Reset the user's password via the admin panel or CLI if forgotten
2. Update stored credentials in scripts/secrets managers after rotation
3. Verify no whitespace or encoding issues in the submitted password
4. For SSO-only users, set a local password first or use the correct auth flow

// confirm credentials are the intended ones before login
if cached == nil || cached.Username != wantUsername { reauth() } // avoid stale creds

func isWrongPassword(err error) bool {
    return err != nil && errors.Is(errors.Cause(err), errs.WrongPassword)
}

token, err := auth.Login(u, p)
if isWrongPassword(err) {
    // prompt/re-set credentials; do not retry with the same password
}

When it happens

Trigger: POST /auth/login with a valid username and wrong password; password changed elsewhere but the client retries with the old one; guest account login with a configured guest password that does not match; copy/paste artifacts (trailing spaces) in the submitted password.

Common situations: Forgotten or rotated passwords; environment credential drift between deployments; OAuth/SSO users trying to log in locally without a local password set; brute-force scans producing it repeatedly (pair with rate limiting).

Related errors

• SafePassword is incorrect
• password is empty
• failed to login into qBittorrent webui with url: {url}
• fast login with cookies failed, and cannot fallback to passw
• cannot login to get refresh token, error: %s

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/afc127fd4de850cb. Report an issue: GitHub.