The login rejects a password you know is correct Common

Before anything else, confirm you are on the real market. A clone will reject correct credentials every time, because it is collecting them rather than checking them.

Check in this order

1. Compare the onion on the login screen against your address bar. Mismatch means stop, and read the entry on address mismatch
2. Reload for a fresh captcha rather than resubmitting an expired one
3. Complete the PGP two factor step if it is enabled, since an unsigned challenge leaves you sitting at the login
4. Try a different verified address, which rules out a half broken session on a loaded one

When it really is the password

If everything above checks out and the password is still refused on a verified address, use the recovery route the market provides. What you never do is type your recovery phrase into any page that asks for it as a login step, because no genuine login does that.

Why a clone rejects everything

A cloned login page has nothing to check credentials against. Its job is to collect what you type and then show an error, because an error keeps you trying and gives it more attempts to capture. If a password that has always worked is suddenly refused, that behaviour is one of the possibilities worth ruling out before any other.

On the real market the far more ordinary explanations are an expired captcha and an unfinished two factor step. Both look like a rejected password from where you are sitting, and both are fixed by reloading and going through the sequence again rather than by changing anything about the account.

What not to do

• Do not try the same password repeatedly on a page you have not verified
• Do not enter the recovery phrase because a page offers it as a faster way in
• Do not reuse a password from another site while troubleshooting