Firebase Error Codes Reference

Firebase Auth, Firestore, Storage, RTDB error codes with description and fix.

A searchable reference for Firebase SDK error codes across Authentication (auth/*), Cloud Firestore, Cloud Storage (storage/*) and Realtime Database — each with the product, meaning and recommended fix. Runs in your browser.

What does the Firebase error auth/user-not-found mean?

auth/user-not-found means there is no user record matching the supplied identifier, typically during email/password sign-in. For security you should show a generic 'invalid email or password' message rather than revealing whether the account exists, since auth/wrong-password leaks the same information.

This is a searchable reference for Firebase SDK error codes across the four products you hit most — Authentication (auth/*), Cloud Firestore, Cloud Storage (storage/*), and the Realtime Database. Each entry names the product, explains the meaning, and gives the fix, so you can turn a cryptic code into a clear next step.

How it works

Firebase SDK errors throw a FirebaseError with a string code and a human message. The code is namespaced by product:

auth/...      Authentication (e.g. auth/wrong-password)
storage/...   Cloud Storage (e.g. storage/unauthorized)
permission-denied / unavailable / not-found   Firestore (gRPC status names)
PERMISSION_DENIED / disconnected               Realtime Database

Branch on error.code, not the localized message, because the message text changes between SDK versions and locales while the code is stable. Auth errors are the most common in client apps; many of them — auth/user-not-found, auth/wrong-password, auth/invalid-credential — should be collapsed into a single generic UI message so you never reveal whether an account exists.

Tips and example

Most Firestore and Storage failures are rules problems, not bugs — the SDK is correctly enforcing the access you configured:

permission-denied   → fix Firestore Security Rules / user claims
storage/unauthorized → fix Storage Security Rules for the path
auth/too-many-requests → back off; the device is temporarily blocked
auth/email-already-in-use → send the user to sign-in or link accounts
unavailable (Firestore) → transient; retry with backoff (offline ok)

Wrap auth calls in a try/catch and switch on the code to produce friendly copy. For Firestore, the unavailable code is transient (often offline) and safe to retry, whereas permission-denied is terminal until the rules change. Everything runs in your browser; nothing is uploaded.