My password works in webmail. Why does SMTP give 535?

SMTP login may be disabled for the account, or the provider may require an app password or OAuth for mail clients.

Can repeated 535 errors get me blocked?

Yes. Many providers lock the account or throttle the IP after several failed logins, so fix the settings before retrying.

SMTP 535: authentication credentials invalid

535Authentication credentials invalidPermanent: retrying will not help

Example

535-5.7.8 Username and Password not accepted.

What it means

RFC 4954 defines 535 with enhanced code 5.7.8 as "Authentication credentials invalid". The client sent AUTH and the server checked the username and secret and said no.

Providers attach their own detail. Gmail says "Username and Password not accepted". Microsoft 365 uses 535 5.7.3 "Authentication unsuccessful" and 535 5.7.139 when SMTP client authentication (basic auth) is disabled for the mailbox or tenant, in which case even a correct password fails. Zoho and others have their own wording, covered on their pages.

It is permanent for that attempt. Repeated failures can lock the account or get your IP rate limited by the provider. Compare with 534 (mechanism or credential type not allowed) and 530 (no login attempted).

Likely causes

The password is wrong, expired, or was changed and the device still stores the old one.
The username is not the full email address or uses the wrong alias.
SMTP AUTH is disabled for the mailbox or tenant (for example Microsoft 365 with SmtpClientAuthentication off).
The account requires an app password or OAuth and the client sends the normal password.
The account is locked or suspended after too many failed attempts.

How to fix it

Log in to webmail with the same username and password to confirm they still work.
Use the full address as the username and re-enter the password in the client; watch for trailing spaces.
On Microsoft 365, ask the admin to enable Authenticated SMTP for that mailbox, or move the app to OAuth or a connector.
For Gmail, Yahoo, or iCloud with two factor sign in, generate an app password and use it in the client.
After a lockout, stop the client, wait for the lock to clear, and fix the credentials before trying again.

Checks that apply

Your domain or sending IP (fills in the checks below)

SMTP Diagnostics Confirms the submission server is up and advertises AUTH over TLS, ruling out a connection problem before you reset credentials.
TCP Port Test Checks that ports 587 and 465 answer from your location, useful when a proxy or ISP interferes with login.

FAQ

My password works in webmail. Why does SMTP give 535?: SMTP login may be disabled for the account, or the provider may require an app password or OAuth for mail clients.
Can repeated 535 errors get me blocked?: Yes. Many providers lock the account or throttle the IP after several failed logins, so fix the settings before retrying.

All 191 bounce codes