Wrong Password

The phrase covers two failures that share nothing except their wording. One is a credential exchange the news server refused, which ends the session before any article is requested. The other is a passphrase that does not decrypt an archive, which occurs after every article has already arrived and been verified. Both write a log line containing the word password, and few clients make the distinction visible in the summary view, so the two get treated as one problem and the wrong thing gets changed.

Reading the stage rather than the wording

Timestamp order settles it immediately. A credential rejection appears in the first lines after a connection opens, next to AUTHINFO and a 481 response, at a point where no transfer statistics exist yet. A passphrase rejection appears at the end of the job, after byte totals and usually after a verification step. If the job has transferred anything at all, the server accepted the login and the remaining problem is local.

The server side: a refused AUTHINFO exchange

A 481 means the server received the username and password and declined them. In rough order of frequency: a typing error, or trailing whitespace pasted along with the value; an account past its expiry date or with an exhausted allowance, which several providers surface as an authentication rejection rather than as a distinct code; a block account fully consumed; and credentials placed in the wrong field, since some providers issue a username separate from the account email address. Where a provider offers IP authentication, an address change invalidates it and produces the same rejection. Repeated failed attempts can trigger a temporary lockout that looks identical until the interval elapses.

The archive side: a passphrase that does not match

An extraction tool handed a passphrase that does not decrypt the archive fails at once and definitively. There is no partial extraction and no progressive corruption; the check happens on the first block. That immediacy is the behavioral difference from a missing passphrase, where the client stops and either waits for input or parks the job. A non-matching passphrase produces a completed attempt with a failure result, reproducible on every retry, while a missing one produces a job that has not attempted extraction at all.

What neither case is

A passphrase failure is not corruption. Running par2 verification against the downloaded set will show every block correct, which is frequently the moment the diagnosis becomes clear. On the server side, a 481 is not a connection limit: exceeding the allowed number of connections is refused after a successful login, and the client's session count will be sitting at its configured maximum when it happens. Nor is it a certificate or TLS fault, which fails earlier still, before any credentials are offered.