Login errors, decoded

01The decoder table

The shape is always Unable to login to Steam3: SomeCode. Find your code:

02InvalidPassword — when the password is definitely right

The tracker's most repeated complaint, with years of issues behind it, and the password is usually not the problem. Four causes, in the order I'd check them:

• Length and encoding. Steam's login protocol truncates at 64 characters and chokes on non-ASCII symbols — a 70-character passphrase from a password manager fails as InvalidPassword with no further hint. If yours is long or contains anything beyond plain ASCII, this is almost certainly it: change the password to 64 ASCII characters or fewer, or sidestep entirely with -qr. This was my own culprit — a long generated passphrase from my manager — and -qr is what I use now to skip the whole question.
• Shell mangling. Passed via the -password flag, characters like !, $, " or % get eaten or expanded by bash, PowerShell and cmd in different, equally creative ways. Don't fight quoting rules — omit the flag and type at the hidden prompt, which takes the string verbatim.
• A stale stored token. If you've used -remember-password before, the rejection may be aimed at the old token, not your password (more in §05). DepotDownloader discards the dead token automatically — so the second attempt, where it asks for the password fresh, often just works.
• An actual typo. It happens to everyone. Log into the Steam website with the same credentials as a ground truth check — if that fails too, the tool was right all along.

03The Steam Guard family

Three codes, one system. AccountLogonDenied means the account uses email Guard — Steam has mailed a code, DepotDownloader is waiting for it. AccountLoginDeniedNeedTwoFactor is the mobile-authenticator equivalent. TwoFactorCodeMismatch and InvalidLoginAuthCode mean the code you entered didn't verify — usually a rotation issue: mobile codes change every 30 seconds, and each new email code invalidates all previous ones, so the freshest one is the only one that counts. Persistent mismatches with codes you're sure about point at clock drift on the device generating them.

By default a Guard-enabled login may also just push a confirmation to your phone — approve it and no code is typed at all. Prefer codes (server in a rack, phone elsewhere)? -no-mobile forces the typed-code path. The full flow per method is in the authentication docs.

04RateLimitExceeded — the hole that digs itself

Steam counted too many login attempts from you and shut the door. The crucial part: further attempts extend the penalty. The retry loop you're tempted to run is the one thing guaranteed to keep you locked out. Walk away for half an hour minimum, then come back with the cause of the original failures fixed (usually one of the InvalidPassword causes above — each automatic retry of a broken script counts toward the limit). Scripted logins are the classic accidental trigger: a cron job with a dead token can burn through the budget overnight. Fix the credentials interactively before re-arming any automation.

05Token & session errors

Expired, Revoked, AccessDenied, InvalidSignature — different flavours of the same event: the refresh token saved by -remember-password is no longer good. Tokens die when you change the account password, hit "deauthorize all devices", or simply after long enough disuse. This is routine, not a fault: DepotDownloader drops the dead token on the spot, and the next interactive login stores a fresh one. The only time it deserves a thought is when a token died and you don't know why — if you didn't change the password or deauthorize, consider whether someone else did, and have a look at your account's authorized devices.

LogonSessionReplaced is its own animal: a second login as the same identity bumped the first mid-download. Two DepotDownloader instances in parallel will do this to each other in a loop — the fix is a unique -loginid (any distinct 32-bit number) per instance. The same collision can come from outside the tool: some other SteamKit-based bot or script sharing the account. One account, one concurrent session per loginid — plan accordingly.

06Asked for a 2FA code on every single run?

Not an error, but it sends people here: every invocation demands a fresh Steam Guard code as if the last login never happened. It didn't — sessions are only persisted when you ask. Add -remember-password to the login and the run after it goes straight through; without the flag, nothing is stored by design. What gets saved is a revocable token, not your password — the authentication docs break down exactly what lands on disk and the safety page covers whether you should let it.

07Two errors that aren't login errors

They arrive near the login and get blamed on it, but belong elsewhere. App … is not available from this account — the login worked; the account just doesn't hold a usable license (family sharing doesn't count, regional packages differ) — full breakdown in the license-error page. And the 401 / No manifest request code pair — also a successful login, followed by Steam declining that specific manifest; that's request-code gating with its own diagnostic tree, and re-entering your password any number of times won't move it. If a login failure is instead followed by a full .NET stack trace rather than a tidy result code, that's a hard crash, not a login error — the crashes & exceptions page covers the NullReferenceException older builds threw after a session failed to establish.

And if you never reached a login prompt at all — the binary refused to launch, threw a .NET error or flashed a console and vanished — that's upstream of everything here; start on the it-won't-even-start page instead. Still stuck on something genuinely login-shaped? The issue tracker wants the exact command (password redacted), the full output, and your Guard type (email or mobile) — those three answer the first round of questions before anyone has to ask them.