amark/gun · error

Wrong user or password.

Error message

Wrong user or password.

What it means

In gun.user.auth, after resolving the alias to a user pub key (act.b), the graph is queried for that pub node. If the returned key is undefined (u === get) — meaning the alias→pub lookup found no matching account — and there are no retries or alias left, auth fails with 'Wrong user or password.'

Source

Thrown at sea/auth.js:39

      var act = {}, u;
      act.a = function(data){
        if(!data){ return act.b() }
        if(!data.pub){
          var tmp = []; Object.keys(data).forEach(function(k){ if('_'==k){ return } tmp.push(data[k]) })
          return act.b(tmp);
        }
        if(act.name){ return act.f(data) }
        act.c((act.data = data).auth);
      }
      act.b = function(list){
        var get = (act.list = (act.list||[]).concat(list||[])).shift();
        if(u === get){
          if(act.name){ return act.err('Your user account is not published for dApps to access, please consider syncing it online, or allowing local access by adding your device as a peer.') }
          if(alias && retries--){
            root.get('~@'+alias).once(act.a);
            return;
          }
          return act.err('Wrong user or password.') 
        }
        root.get(get).once(act.a);
      }
      act.c = function(auth){
        if(u === auth){ return act.b() }
        if('string' == typeof auth){ return act.c(obj_ify(auth)) } // in case of legacy
        SEA.work(pass, (act.auth = auth).s, act.d, act.enc); // the proof of work is evidence that we've spent some time/effort trying to log in, this slows brute force.
      }
      act.d = function(proof){
        SEA.decrypt(act.auth.ek, proof, act.e, act.enc);
      }
      act.e = function(half){
        if(u === half){
          if(!act.enc){ // try old format
            act.enc = {encode: 'utf8'};
            return act.c(act.auth);
          } act.enc = null; // end backwards
          return act.b();

View on GitHub (pinned to 552227599d)

Solutions

1. Verify the alias was created via gun.user().create(alias, pass) and completed (ack without err)
2. Ensure the app is connected to the same peers/storage where the account exists
3. Check the alias spelling and casing exactly matches the registered one
4. Handle the ack.err callback to surface the message instead of letting auth fail silently

Example fix

// before
gun.user().auth(alias, pass);
// after
gun.user().auth(alias, pass, ack => {
  if (ack.err) {
    console.error('auth failed:', ack.err); // 'Wrong user or password.'
    return;
  }
  console.log('logged in as', gun.user().is.alias);
});

gun.get('~@' + alias).once(v => {
  if (!v) console.warn('alias not registered on this graph');
});

gun.user().auth(alias, pass, ack => {
  if (ack && /Wrong user or password/.test(ack.err)) {
    // prompt user to re-enter credentials / check alias
    return;
  }
  if (ack && ack.err) { console.error(ack.err); return; }
});

When it happens

Trigger: user.auth(alias, password) where the alias was never registered (root.get('~@'+alias) resolves to nothing) or the password is incorrect so proof matching fails; retries counter exhausted after repeated alias lookups; calling auth against a gun instance/graph that does not contain the account.

Common situations: Typo in the alias; authenticating before user.create completed/replicated to the connected peers; connecting to a different gun storage/peer set than where the account was created; case-sensitivity differences in the alias.

Related errors

• Your user account is not published for dApps to access, plea
• User cannot be found!
• First argument must be a string, Buffer, ArrayBuffer, Array,
• Invalid first argument for type 'hex'.
• First argument must be Array containing ArrayBuffer or Uint8

AI-assisted analysis of amark/gun@552227599d (2026-09-02). Data as JSON: /api/errors/9cdad215493f4e7d. Report an issue: GitHub.