diff --git a/go.mod b/go.mod
index 696186bc37a8e0d5ba86599c72172e90d8925b10..93702e4b44260b30d3a238ab351d003bcc7fc416 100644
--- a/go.mod
+++ b/go.mod
@@ -6,7 +6,7 @@ toolchain go1.24.1
 
 require (
 	git.autistici.org/ai3/go-common v0.0.0-20250125130542-62b40adde91d
-	git.autistici.org/id/auth v0.0.0-20241017204112-73812019f8b2
+	git.autistici.org/id/auth v0.0.0-20250317113727-af5086998135
 	git.autistici.org/id/go-sso v0.0.0-20241017184626-0e26b5e055dc
 	git.autistici.org/id/keystore v0.0.0-20230901162242-63f23c4799e9
 	git.autistici.org/id/usermetadb v0.0.0-20241017171915-b5c24a0ff9b7
diff --git a/go.sum b/go.sum
index 483d3475bc80750aff5406dad4814bcb02a779fe..8c98017d2e093588575f89c4b40c6531d1fd60e6 100644
--- a/go.sum
+++ b/go.sum
@@ -64,6 +64,8 @@ git.autistici.org/id/auth v0.0.0-20240906122543-bdae984d05cd h1:m4CRIt/3Zv40/cEE
 git.autistici.org/id/auth v0.0.0-20240906122543-bdae984d05cd/go.mod h1:wBtDkNIYOwSU+i4hOiKOM0C40HSZylGZbFXhyrKk0hA=
 git.autistici.org/id/auth v0.0.0-20241017204112-73812019f8b2 h1:K6HeELCAypbrF9SlsxdWOYduw6bERy83mPuXDfYDLy8=
 git.autistici.org/id/auth v0.0.0-20241017204112-73812019f8b2/go.mod h1:exRuu1+EazJrZBwC27XoPRXymwbXMDjsu/Q+GMMlS4s=
+git.autistici.org/id/auth v0.0.0-20250317113727-af5086998135 h1:v6D6egIdYvSPNNZwjeLlMhw5yzkXnNZrA/vIUmjJiak=
+git.autistici.org/id/auth v0.0.0-20250317113727-af5086998135/go.mod h1:YzbKrzXdEGyHwxBEmladn81ypJVBG4q61WD++Co+zUo=
 git.autistici.org/id/go-sso v0.0.0-20230822064459-ed921a53bb33 h1:Z3kE2hayP75WNItTfODiC6zUiGiVtYEp00OVpx4YndE=
 git.autistici.org/id/go-sso v0.0.0-20230822064459-ed921a53bb33/go.mod h1:n3YNIlKKfYWYqPGPLh4KDT1QpOVqoSp8w3l4DBR/oXk=
 git.autistici.org/id/go-sso v0.0.0-20241017184626-0e26b5e055dc h1:Zdu47ZFAgvEiNijZ/UVsCjaM8/EbsYbLTLI7S/JFbzI=
diff --git a/login/state.go b/login/state.go
index 8e0fdbe231dd200aac5b6e40a5d5993fbd377b35..aea85df048d3addafa68bcfdb5910ee61d212c23 100644
--- a/login/state.go
+++ b/login/state.go
@@ -133,14 +133,14 @@ func (l *loginState) authRequestFromRequest(req *http.Request, deviceInfo *userm
 		l.Password = req.FormValue("password")
 		return &auth.Request{
 			Username:   l.Username,
-			Password:   []byte(l.Password),
+			Password:   l.Password,
 			DeviceInfo: deviceInfo,
 		}, nil
 
 	case State2FA_OTP:
 		return &auth.Request{
 			Username:   l.Username,
-			Password:   []byte(l.Password),
+			Password:   l.Password,
 			DeviceInfo: deviceInfo,
 			OTP:        req.FormValue("otp"),
 		}, nil
@@ -153,7 +153,7 @@ func (l *loginState) authRequestFromRequest(req *http.Request, deviceInfo *userm
 		}
 		return &auth.Request{
 			Username:         l.Username,
-			Password:         []byte(l.Password),
+			Password:         l.Password,
 			DeviceInfo:       deviceInfo,
 			WebAuthnSession:  l.AuthResponse.WebAuthnSession,
 			WebAuthnResponse: webauthnResp,
diff --git a/vendor/git.autistici.org/id/auth/protocol.go b/vendor/git.autistici.org/id/auth/protocol.go
index 0df709d023f600cdae1fa7f19635d72e66576d3e..90d8320b4f66b7bc528ef171d74a96c023e94baa 100644
--- a/vendor/git.autistici.org/id/auth/protocol.go
+++ b/vendor/git.autistici.org/id/auth/protocol.go
@@ -16,7 +16,7 @@ import (
 type Request struct {
 	Service          string
 	Username         string
-	Password         []byte
+	Password         string
 	OTP              string
 	WebAuthnSession  *webauthn.SessionData
 	WebAuthnResponse *protocol.ParsedCredentialAssertionData
@@ -26,7 +26,7 @@ type Request struct {
 func (r *Request) EncodeToMap(m map[string]string, prefix string) {
 	m[prefix+"service"] = r.Service
 	m[prefix+"username"] = r.Username
-	m[prefix+"password"] = string(r.Password)
+	m[prefix+"password"] = r.Password
 
 	if r.OTP != "" {
 		m[prefix+"otp"] = r.OTP
@@ -47,7 +47,7 @@ func (r *Request) EncodeToMap(m map[string]string, prefix string) {
 func (r *Request) DecodeFromMap(m map[string]string, prefix string) {
 	r.Service = m[prefix+"service"]
 	r.Username = m[prefix+"username"]
-	r.Password = []byte(m[prefix+"password"])
+	r.Password = m[prefix+"password"]
 	r.OTP = m[prefix+"otp"]
 	if s := m[prefix+"webauthn_session"]; s != "" {
 		var sess webauthn.SessionData
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 7862d047ccbaf0edabd9d472339bd8902d540989..4a05d044a99afc93bec126a04708e7fd0caf00b5 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -4,7 +4,7 @@ git.autistici.org/ai3/go-common
 git.autistici.org/ai3/go-common/clientutil
 git.autistici.org/ai3/go-common/serverutil
 git.autistici.org/ai3/go-common/tracing
-# git.autistici.org/id/auth v0.0.0-20241017204112-73812019f8b2
+# git.autistici.org/id/auth v0.0.0-20250317113727-af5086998135
 ## explicit; go 1.21.0
 git.autistici.org/id/auth
 git.autistici.org/id/auth/client