You type the right password. You're sure it's right — you just copied it out of your password manager. And Proxmox VE throws it back at you anyway: "Login failed. Please try again." No detail, no hint about what's wrong.
This is one of the most common things new Proxmox users hit, usually within the first ten minutes of setting up their server. The good news: it's almost never actually a wrong password. It's a dropdown on the login screen that nobody explains — the Realm field — and once you understand what it does, this error stops being confusing forever.
What You Will Learn
By the end of this guide you'll know what a realm is, why Proxmox VE has more than one of them, and how to pick the right one so login stops failing. You'll also set up a proper non-root user the correct way, so you're not logging in as root for every little task. And you'll walk through the other, less common reasons login can fail — locked accounts, two-factor codes, and a couple of browser quirks that trip people up.
What Is a Realm in Proxmox VE?
A realm is just the place Proxmox VE checks to see if your username and password are correct. It's not a Proxmox-specific idea — plenty of systems support multiple ways to authenticate — but Proxmox puts the choice front and center on the login page, and that's exactly where beginners get tripped up.
On a fresh install, you get two realms by default:
- Linux PAM standard authentication — this checks against the actual Linux user accounts on the host, the same accounts you'd see in
/etc/passwd. This is whererootlives. - Proxmox VE authentication server — this is Proxmox's own internal user database, stored in
/etc/pve/user.cfg. Accounts here exist only inside Proxmox and have nothing to do with the operating system's login accounts.
Internally, every account is identified as username@realm. Root on the PAM realm is root@pam. A user you create inside Proxmox is something like bob@pve. Two different usernames can even share the same password and still fail to log in, because you told Proxmox to check the wrong list.
Why Would You Use It?
Understanding realms isn't just about fixing an error message — it changes how you should actually run your server. Using root@pam for daily work is fine when you're kicking the tires on a homelab box, but it's a bad habit long-term. Root can do absolutely anything, including things a typo can't undo.
Once you understand realms, you can create a separate @pve account with only the permissions it actually needs — say, the ability to manage VMs but not touch storage configuration or user accounts. That's the whole idea behind Proxmox's permission system, and it starts with knowing which realm an account lives in.
Realms also matter the moment you want to connect Proxmox to something bigger, like an LDAP directory or Active Directory. Those show up as additional realms too, and the exact same login screen logic applies. You don't need any of that for this guide, but it's worth knowing the same mental model scales up.
Prerequisites
You'll need:
- A working Proxmox VE installation you can reach at
https://your-server-ip:8006 - The actual root password, set during installation (if you've genuinely forgotten it, that's a GRUB recovery process, not a realm problem — different fix, different article)
- SSH or physical/console access to the server, in case the web UI is completely unreachable
- About fifteen minutes
None of this requires a subscription. Everything here works identically on the free, no-subscription repository.
Step-by-Step Tutorial
Step 1: Confirm Which Realm Your Account Actually Uses
Open the login page. Below the User name and Password fields you'll see a Realm dropdown. On a fresh install it usually defaults to Linux PAM standard authentication, which is correct for root.
Here's the part that catches people out: once you create even one @pve user, some browsers — and sometimes the UI itself after a previous session — will remember the last realm you used and pre-select it the next time. If you're trying to log in as root and the dropdown is quietly sitting on Proxmox VE authentication server, root won't be found there, and you'll get the exact same generic "Login failed" message you'd get from a typo.
So step one, every time this happens: check the dropdown before you touch the password field again.
Step 2: Log In as root the Right Way
For the built-in root account, the correct combination is:
- User name:
root - Password: the one you set during installation
- Realm: Linux PAM standard authentication
Type the username as just root, not root@pam — the interface appends the realm for you based on the dropdown. If you paste in root@pam by habit from a command line, some versions of the UI will treat that whole string as the username and fail to match it, which just adds another layer of confusion on top of the same underlying problem.
Step 3: Create a Proper PVE-Realm User (Instead of Using root Every Day)
Once you're in, go to Datacenter → Permissions → Users → Add. Set:
- User name: something like
bob - Realm: Proxmox VE authentication server
- A password that meets the complexity requirements shown in the dialog
Or from the shell, the same thing looks like this:
pveum user add bob@pve
pveum passwd bob@pveThe second command prompts you to set a password interactively. Note that pveum user add creates the account entry but doesn't set a password by itself — that's what pveum passwd is for. Skip it and the account exists but can't log in, which looks exactly like our original error if you try it too soon.
Step 4: Assign Permissions So the New User Can Actually Do Something
A brand-new @pve user has zero permissions by default. Logging in will work, but the interface will look almost empty — no nodes, no VMs, nothing to click. That's not a bug, it's Proxmox being deliberately locked-down by default.
Go to Datacenter → Permissions → Add → User Permission, pick the path (usually / for the whole datacenter while you're learning), select your new user, and assign a role like PVEAdmin or PVEVMAdmin depending on how much access you want to hand out. From the CLI:
pveum acl modify / -user bob@pve -role PVEAdminStart narrower than you think you need. It's much less painful to add permissions later than to figure out, six months from now, why a semi-trusted account can delete storage pools.
Step 5: Reset a Forgotten pve-Realm Password
If bob@pve forgets their password, that's a much easier fix than the root GRUB recovery process — because @pve accounts aren't tied to the operating system at all. Log in as root@pam or another admin account and run:
pveum passwd bob@pveOr do the same thing from Datacenter → Permissions → Users, select the user, and click Reset password. No reboot, no recovery mode, no downtime for the host.
Commands Explained
pveum is the Proxmox VE user management command-line tool — think of it as the terminal equivalent of the Permissions section in the web UI.
pveum user list— shows every user account across every realm, so you can confirm an account actually exists before assuming the password is wrongpveum realm list— shows which realms are configured on this server (by default, justpamandpve)pveum user add bob@pve— creates a new user record in the specified realm; note the realm is part of the argument, not a separate flagpveum passwd bob@pve— sets or resets the password for apve-realm user (this does not work for PAM users — those get their password changed with the normal Linuxpasswd bobcommand, run as root)pveum acl modify / -user bob@pve -role PVEAdmin— grants a role to a user at a given path in the resource tree;/means "everything"
Common Errors
A few messages and situations people run into around this same problem:
| What you see | What's actually happening |
|---|---|
| Login failed. Please try again. | Almost always wrong realm selected, or the account doesn't exist in that realm |
| Login succeeds but the UI is nearly empty | Account has no permissions assigned yet — see Step 4 |
| Login failed after entering a correct TOTP code | Server clock drift, or the code expired between typing and submitting (codes rotate every 30 seconds) |
| Account works from SSH but not the web UI | SSH uses the Linux PAM stack directly; the web UI still needs the right realm selected and, separately, Proxmox permissions to show anything useful |
Troubleshooting
If you've confirmed the realm is right and it's still failing, work through these in order.
First, rule out a simple typo. Caps Lock is the classic culprit, and password managers that autofill into the wrong field are a close second — check that the password field actually contains what you think it does, not what got pasted into the username field by mistake.
Second, check for repeated failed attempts locking the account. Debian's PAM stack can trigger pam_faillock after too many bad tries in a row, which locks the account temporarily even once you start using the right password. From the console:
faillock --user rootIf it shows recent failures, clear them with:
faillock --user root --resetThird, if you can't reach the login page at all — not even a failed-login message, just a timeout or connection refused — that's not a realm issue. Check that the pveproxy service is running:
systemctl status pveproxyRestart it if needed with systemctl restart pveproxy, and check journalctl -u pveproxy -n 50 for anything obviously wrong, like a certificate error.
Fourth, if you have two-factor authentication enabled on the account, remember that "Login failed" also shows up for a wrong or expired TOTP code, not just a wrong password — the UI doesn't distinguish which factor failed. Double-check your device's clock is accurate, since TOTP codes are time-based and a few minutes of drift is enough to invalidate every code you generate.
Best Practices
Don't make root@pam your everyday login. Create a @pve account with a sensible role and save root for genuine administrative work — package updates, storage changes, that kind of thing. It's a small habit that saves you from a very bad day eventually.
Give new accounts the least access that gets the job done, then widen it later if you actually need to. PVEVMAdmin is usually enough for someone who just needs to manage virtual machines and shouldn't be touching cluster storage.
If your browser is auto-filling the wrong realm out of habit, it's worth just bookmarking the login page fresh, or clearing saved autofill entries for that page. It sounds trivial, but it's the single most common repeat cause of this error for people who've already fixed it once.
Turn on two-factor authentication for any account with real permissions, but test it immediately after setup while you still have another way in — an admin session in a second browser tab, for instance. Getting locked out of a TOTP-protected account you just configured is an entirely avoidable headache.
Frequently Asked Questions
Why doesn't Proxmox just tell me the realm is wrong?
For security reasons. A message like "wrong realm" or "user not found" tells an attacker something useful about which accounts exist. A generic failure message doesn't.
Can I delete the PVE realm and only use PAM, or the other way around?
No, both default realms are built in and can't be removed. You can simply choose not to create any @pve accounts if you'd rather manage everything through Linux system users.
Is root@pam the same as the Linux root user?
Yes. It's the same account you'd get logging into an SSH session as root — same password, same everything. Proxmox VE doesn't maintain a separate root identity.
I created a user but I can't find them when adding permissions. Why?
Make sure you selected the same realm the account was actually created in when searching the user list. It's easy to create bob@pve and then go looking for just "bob" without the realm suffix.
Does this apply to Proxmox Backup Server too?
Yes, PBS uses the same realm concept with its own separate user database, though it's a different product with its own login page and its own pam/pbs realms.
Conclusion
Nine times out of ten, "Login failed. Please try again." in Proxmox VE has nothing to do with your password — it's the Realm dropdown pointing at the wrong place to check it. Once you know root lives in Linux PAM and everything else you create lives in the Proxmox VE authentication server, the error stops being mysterious.
Take the extra few minutes to set up a proper @pve account with scoped permissions while you're in there. Future you, working late on a server you haven't touched in months, will be glad root isn't the only way in.