How to Fix ‘Your Credentials Could Not Be Verified’ in Windows 11

The lock screen error message “Your credentials could not be verified” (or “Something went wrong and your PIN isn’t available”) prevents users from signing into their Windows 11 user accounts. This authentication roadblock occurs when the Local Security Authority Subsystem Service (LSASS) or Windows Hello fails to validate cryptographic keys against the system’s Trusted Platform Module (TPM 2.0) or local Security Accounts Manager (SAM) database. Resolving this issue involves switching to alternative sign-in options, purging the corrupted NGC credential container, and repairing damaged security components.

Why Windows 11 Fails to Verify Credentials

Windows 11 mandates strict cryptographic authentication. Features like Windows Hello PIN and biometric sign-in store asymmetric keys inside hardware-backed storage (TPM). When you enter your PIN, the TPM decodes the user token to unlock your account profile. If the keys in the local NGC container fall out of synchronisation with the TPM hardware registers—often after a major Windows update, BIOS flashing, or unexpected power loss—Windows displays Your credentials could not be verified.

The principal causes include:

• Corrupted NGC Directory: The hidden system folder (C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc) containing cryptographic credential links has become corrupted.
• TPM State Desynchronisation: Motherboard firmware updates or clearing CMOS settings resetting the TPM cryptographic hierarchy. For broader state machine issues, see our tutorial on fixing the group or resource is not in the correct state in Windows 11.
• Corrupted Windows Security Subsystems: Damaged system DLL files preventing LSASS from communicating with authentication providers.
• Microsoft Account Password Changes: Password changes made on another device not yet synchronised with the local Windows 11 offline cache.

Security Layer	Role in Authentication	Failure Condition
TPM 2.0 Chip	Stores hardware-bound private keys	Firmware cleared or platform hierarchy disabled in UEFI
NGC Container	Maps Hello PIN to stored TPM keys	Corrupted ACL permissions or orphaned key container
Credential Manager	Maintains local cached identity tokens	Desynchronised account tokens following cloud password change
LSASS Daemon	Validates security tokens and user rights	Crash dump or integrity verification failure

Step 1: Use Alternative Sign-In Options at the Lock Screen

Windows Hello PIN errors do not necessarily mean your account password is invalid. You can often bypass the failed credential check using your primary password:

1. On the Windows 11 lock screen, click directly below the PIN entry field where it says Sign-in options.
2. Click the Key icon to select the standard password entry option.
3. Enter your full Microsoft Account password (or local administrator password).
4. Ensure your device is connected to the internet (via Wi-Fi or Ethernet) so Windows can verify newly changed account credentials against Microsoft’s authentication servers.

Step 2: Boot into Safe Mode and Delete the NGC Credential Folder

If you cannot sign in using alternative options, booting into Safe Mode allows you to clear the corrupted NGC credential database, forcing Windows 11 to reset your PIN cleanly.

1. On the lock screen, hold down the Shift key and click the Power icon > Restart.
2. Windows will reboot into the Windows Recovery Environment (WinRE).
3. Navigate to Troubleshoot > Advanced options > Startup Settings and click Restart.
4. Press 4 or F4 to launch Enable Safe Mode.
5. Sign in using your administrator password.
6. Press Windows Key + E to open File Explorer, click View > Show, and ensure Hidden items is ticked.
7. Navigate to the following directory:

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\

8. Locate the folder named Ngc.
9. Right-click Ngc, select Properties > Security > Advanced, change the Owner to your current user account, and grant yourself Full Control.
10. Delete all files and folders inside the Ngc folder (or delete the folder itself).
11. Restart your PC normally. Go to Settings > Accounts > Sign-in options and set up a new Windows Hello PIN.

Step 3: Clear TPM via the Trusted Platform Module Management Console

If the hardware security module contains orphaned cryptographic bindings, clearing the TPM forces the security chip to generate a fresh root key.

1. Once signed into Windows (via Password or Safe Mode), press Windows Key + R.
2. Type tpm.msc and press Enter to open the TPM Management Console.
3. In the right-hand Actions pane, click Clear TPM….
4. Confirm the prompt. Windows will prompt you to restart the computer.
5. During reboot, your computer’s UEFI firmware may display a security prompt asking you to press F12 or F1 to confirm clearing the TPM. Press the requested key to approve.
6. Upon reaching the lock screen, configure a new PIN.

Step 4: Execute System Integrity Scans via Terminal

Damaged system authentication binaries can trigger credential verification errors. Running DISM and SFC repairs corrupted system manifests.

1. Press Windows Key + X and choose Terminal (Admin).
2. Execute the following commands sequentially:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

For additional details on repairing stubborn system file errors, see our troubleshooting guide on fixing SFC Scannow Windows Resource Protection errors.

Step 5: Switch to a Local Account Temporarily

If account synchronisation between Microsoft cloud servers and your local machine is trapped in an irrecoverable state, transitioning to a local account restores clean offline credentials.

1. Press Windows Key + I to open Settings.
2. Click Accounts, then select Your info.
3. Under Account settings, click Sign in with a local account instead.
4. Enter your current password to verify identity, then create a local username and password.
5. Sign out and sign back in. Once verified, you can reconnect your Microsoft Account through the same menu to refresh all cloud tokens cleanly.