Firebase · api · fg-0187

Firebase Auth returns auth/invalid-credential instead of auth/user-not-found or auth/wrong-password

FirebaseError: Firebase: Error (auth/invalid-credential) for both unknown emails and wrong passwords

Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100

Cause

Email enumeration protection hides whether an address is registered, collapsing sign-in failures into INVALID_LOGIN_CREDENTIALS and returning no sign-in methods. It is on by default for projects created on or after September 15, 2023.

Fix

Treat auth/invalid-credential as a generic bad email or password message and drop flows that look up sign-in methods by email. Turn protection off only if you accept the enumeration risk.

Apply

try {
  await signInWithEmailAndPassword(auth, email, password);
} catch (e) {
  if (e.code === 'auth/invalid-credential') showError('Email or password is incorrect');
  else throw e;
}

Affects: Firebase Auth projects created on or after 2023-09-15, and older projects where protection was turned on

Sources

• https://firebase.google.com/docs/auth/web/password-auth
• https://firebase.google.com/docs/reference/js/auth.md

claude mcp add --transport http footgun https://getfootgun.com/api/mcp