Culvert VPN"Authentication failed" and other VPN errors, decoded
On a VPN app with no password, "authentication failed" almost always means an expired session or a wrong phone clock. Fix the time and reconnect first.
On a VPN app you never typed a password into, "authentication failed" almost always means one of two things: the session the app was using has expired, or the phone's clock is far enough from the server's that the app's credentials look invalid. It is rarely about the account. Check that date and time are set automatically, reconnect once, and only if that fails start looking at the account itself.
Why a VPN talks about authentication at all
A modern VPN app does not log you in with a username and password each time. The app holds a key on the phone, uses it to prove to the provider's servers that this is the same device that registered, and receives a short-lived token in return. Each time you connect, the app presents that token, the server authorises a connection on a specific VPN server, and the tunnel is set up with keys minted for that one session. The handshake post walks through that exchange.
"Authentication" in an error message means one of those steps was refused. Because there is no password, the refusal is about time and state rather than about anything you typed.
The clock
Everything in that chain carries a time. Tokens have an expiry. Certificates are valid from one moment to another. Some handshakes include a timestamp to stop old packets being replayed. All of these are compared against the server's clock, and the server's clock is correct.
If your phone's clock is wrong, a token that is entirely valid can look like it has not started yet, or has already ended. Certificates that are fine on the server appear expired on the phone. The result is an authentication or certificate error that has nothing to do with you.
Phones drift when automatic time is turned off, after a battery ran completely flat, or when a travel SIM never set the time zone. Open Settings, search for date and time, and turn on automatic date, time and time zone. Then reconnect.
The expired session
Sessions do not last forever. Free tiers limit how long one session runs, and a well-designed service puts a hard ceiling on every session, often a day, so that keys are replaced regularly. When the session ends, the credentials the app was holding stop working, and an app that tries to reuse them gets an authentication refusal.
The right behaviour is for the app to notice, request a new session and reconnect, without you doing anything; the session expiry post explains why sessions end at all. If you see the error once and the next connect works, that is what happened. If it repeats, the app's stored state is stale: on a Premium account, sign out and back in; on a free tier without an account, reconnecting after a fresh app start usually lets it re-register.
Other messages, and what each one usually means
| Message | Usually means | First thing to try |
|---|---|---|
| Authentication failed | Expired session or clock skew | Automatic time on, reconnect |
| Certificate invalid or not yet valid | Clock skew, or a network intercepting HTTPS | Fix the clock; try mobile data |
| Handshake timed out | The network dropped the packets, often UDP | Wait for the app to try another method |
| Connection reset | The network closed the connection mid-handshake | Same; or switch networks |
| Server unavailable / at capacity | The city you chose is full or unhealthy | Pick another city, or the country |
| Another VPN is active | A second VPN or always-on profile holds the slot | Turn it off in Settings, VPN |
| Permission denied / cancelled | The system VPN prompt was declined | Reconnect and accept it |
| Device limit reached | All slots on a Premium plan are in use | Remove a device from the plan |
A handshake timeout is the most common of these on hotel, campus and office Wi-Fi, and it is not an error the app is expected to surface for long. A good app treats it as "this method is blocked here" and moves to the next one, which looks like a longer "connecting" rather than a failure. If you only ever see it on one network, the not connecting checklist has the steps.
When it really is the account
Three cases are about the account rather than the connection. A Premium plan has a device limit, and a sixth phone is refused until one is removed. A subscription that lapsed drops the account back to the free tier, so a Premium-only city refuses the connection. And an account deleted from another phone cannot connect from this one. All of them come with their own message rather than a plain "authentication failed", and none of them is fixed by reinstalling.
What the error is not
It is not a sign that the network is unsafe, that someone is intercepting your traffic, or that the VPN's encryption has failed. A refused authentication is the system working: a credential outside its window was declined. The one exception worth noting is a certificate error on a network that inspects HTTPS, which is the network inserting itself into the connection; the fix there is to use mobile data rather than to accept the certificate.
Culvert VPN issues short-lived sessions signed by a key that lives on the phone, renews them automatically when a free session or the daily ceiling ends, and reconnects without asking you to sign in again; it is on Google Play.
Questions people also ask
I never set a password, so what is it authenticating?
Your device's key and a short-lived session token. The app signs each connection with a key kept on the phone, and the server checks it against the account it created for that key. There is no password anywhere in the exchange.
Why would a wrong clock cause an authentication error?
Session tokens and certificates carry validity times. If the phone thinks it is an hour earlier than the server does, a token that is perfectly valid looks like it has not started yet, and the server refuses it.
Does "authentication failed" mean my account is blocked?
Almost never. If the time is right and a fresh reconnect still fails, the app's stored session is stale; signing out and back in on Premium, or letting the app re-register on the free tier, clears it.