# fastapi.security.OAuth2PasswordRequestForm: 400 Bad Request: Incorrect username or password

- **ID:** `python/fastapi-oauth2-password-error`
- **Domain:** python
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

The OAuth2 password flow receives invalid credentials, either because the user doesn't exist or the password hash doesn't match.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 3.x | active | — | — |

## Workarounds

1. **** (95% success)
   ```
   Use passlib and bcrypt: from passlib.context import CryptContext\npwd_context = CryptContext(schemes=['bcrypt'], deprecated='auto')\nif not pwd_context.verify(password, user.hashed_password):\n    raise HTTPException(400)
   ```
2. **** (90% success)
   ```
   Check if the user exists first: user = db.query(User).filter(User.username == username).first()\nif not user:\n    raise HTTPException(400)
   ```

## Dead Ends

- **** — Storing plaintext passwords and comparing directly is insecure and may cause hash mismatches. (90% fail)
- **** — Using the wrong hashing algorithm (e.g., md5) can cause verification failures. (70% fail)