Does 432 mean my password is wrong?

No. A wrong password gives 535. 432 means the server accepts who you are but wants the password migrated or changed before it lets this mechanism through.

Will 432 ever appear on a bounce from a remote domain?

Very rarely. It is a submission side reply, so you see it in your mail client or app log rather than in a non delivery report from another organisation.

SMTP 432 4.7.12: password transition needed

432A password transition is neededTemporary: the sender retries

Typical wording

432 4.7.12 A password transition is needed

What it means

Reply 432 comes from the SMTP AUTH extension in RFC 4954, which pairs it with enhanced code 4.7.12 and the text "A password transition is needed". It appears only during authenticated submission, when a mail client or application logs in to a submission server with AUTH. Delivery between MX hosts never produces it.

The server is saying the credentials are recognised but the account must move to a new password or a new mechanism first. RFC 4954 describes the typical case: the user must authenticate once with a plain text mechanism such as PLAIN so the server can convert a stored password into the form a stronger mechanism needs.

Because it is a 4xx reply, the client may try again, but repeating the same login will keep failing until the account changes. It differs from 535 (wrong credentials) and 534 (mechanism too weak), which are permanent refusals of the attempt.

Likely causes

The mail server migrated its password store and needs one login over PLAIN (inside TLS) to rehash the credential for a mechanism like SCRAM.
An administrator flagged the account for a forced password change and the server reports that at SMTP AUTH time.
The client insists on a challenge response mechanism (such as CRAM-MD5) for which the server has no usable stored secret yet.
An old application profile keeps an obsolete mechanism preference that the server no longer supports for this account.

How to fix it

Confirm the reply comes from AUTH on the submission port (587 or 465) and not from an MX. The client log line just before the 432 should show an AUTH command.
Log in once with webmail or the provider’s portal and complete any password change it asks for.
Set the client to use PLAIN or LOGIN over TLS for one session so the server can upgrade the stored secret, then switch back to a stronger mechanism if you want.
If you run the server, check its authentication backend (for example Dovecot’s passdb scheme) and confirm users have a hash the advertised mechanisms can use.

Checks that apply

Your domain or sending IP (fills in the checks below)

SMTP Diagnostics Connects to the submission host and shows whether STARTTLS works and which AUTH mechanisms are advertised, so you know a PLAIN login is protected.
TCP Port Test Verifies port 587 or 465 is reachable from outside, ruling out a firewall before you chase account settings.

FAQ

Does 432 mean my password is wrong?: No. A wrong password gives 535. 432 means the server accepts who you are but wants the password migrated or changed before it lets this mechanism through.
Will 432 ever appear on a bounce from a remote domain?: Very rarely. It is a submission side reply, so you see it in your mail client or app log rather than in a non delivery report from another organisation.

All 191 bounce codes