Skip to content
Get a quote

Firebase Authentication errorWhy does Firebase sign-in fail with auth/invalid-credential?

Sign-in with email and password fails, and the error is auth/invalid-credential instead of the user-not-found or wrong-password your code checks for. Here’s why Firebase does that, what to change in your app, or hand it over at a fixed price.

Short answer

With email enumeration protection on, which is the default for projects created on or after September 15, 2023, Firebase returns auth/invalid-credential for any invalid email or password, so your app can’t tell which one was wrong. Show one message such as “Email or password is incorrect”, stop branching on user-not-found and wrong-password, and make the forgot-password flow say an email was sent if the account exists. With protection on, a mistyped password gets the same code, so check the password too.

Find which case you’re in, then fix it

  1. 01

    Email enumeration protection hides which field was wrong

    “When Email Enumeration Protection is enabled, this method fails with "auth/invalid-credential" in case of an invalid email/password.” Firebase, Firebase JS SDK: auth package

    Firebase no longer says whether the email doesn’t exist or the password is wrong, because that answer lets attackers confirm which emails have accounts. Code that shows a different message for user-not-found and wrong-password never reaches those branches. Catch auth/invalid-credential and show one message for both.

    import { signInWithEmailAndPassword } from 'firebase/auth';

try {
  await signInWithEmailAndPassword(auth, email, password);
} catch (e) {
  if (e.code === 'auth/invalid-credential') {
    showError('Email or password is incorrect.');
  } else {
    throw e;
  }
}

  2. 02

    Your project was created after September 15, 2023

    “If you created your project on or after September 15, 2023, email enumeration protection is enabled by default.” Google Cloud, Enable or disable email enumeration protection

    Newer projects have the protection on from day one, so error handling copied from an older tutorial may check for codes your app no longer receives. Older projects can have it switched on later in Authentication settings, under User actions.

  3. 03

    The app checks whether an email exists before signing in

    “A list of sign-in methods for a specified email address is no longer returned” Google Cloud, Enable or disable email enumeration protection

    A sign-in screen that first asks Firebase which sign-in methods an email uses, to decide between a password field and a Google button, gets nothing back once the protection is on. Ask for the password directly, or offer every sign-in option on one screen.

  4. 04

    Forgot password says nothing for unknown emails

    “When you make a password reset request, a verification email is sent only if the email address exists” Google Cloud, Enable or disable email enumeration protection

    Password reset sends an email only when the address has an account, and returns no error when it doesn’t. Word the confirmation so it’s true either way: “If an account exists for this email, we sent a reset link.”

  5. 05

    Turning the protection off

    “If your app relies on any of the behaviors changed by email enumeration protection, you can disable it. However, this is not recommended in the long term” Google Cloud, Enable or disable email enumeration protection

    You can switch it off if your app depends on the old behavior, but Google recommends against it in the long term. Updating the sign-in screen is often simpler.

Checked against the vendor’s docs on : Firebase JS SDK reference: auth package; Google Cloud docs: Enable or disable email enumeration protection.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

Related: Firebase auth/unauthorized-domain · Google Sign-In DEVELOPER_ERROR on Android · Firebase security guide · Unexpected Gemini API charges on Firebase

Questions

More on this error

How do I tell the user whether the email or the password was wrong?

With email enumeration protection on, you don’t: Firebase returns the same code for both on purpose. One message for both cases is the expected design.

Is auth/invalid-credential only about email and password?

Not always. Firebase’s list of auth error codes also gives INVALID_IDP_RESPONSE the code auth/invalid-credential, so a rejected response from an identity provider can carry the same code. Check which sign-in method failed.

What do you need to see to fix it?

The sign-in and password reset code, the exact error, and whether email enumeration protection is on in your Firebase Authentication settings.

Can you fix it for me?

If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way.

A different error?

Describe it and get a written quote

Send the error and what you were doing. You get a written scope, a fixed price and a timeline; we reply by email, usually within one business day.

Describe your problem All fixes