FYI, I could not connect to either of my GMail accounts this morning using OAUTH2 due to reported invalid authentication credentials. My app password connection still worked. Revalidation of GMail OAUTH2 was required to fix the OAUTH2 issue. This has been a recurring issue for me (third time since creating OAUTH2 authentication).

Had the same issue Sunday morning. Checked and the last time it occured was last November on the morning of the time change as well. All three email accounts on 6 computers had to be revalidated. I did 3 on Sunday and the other 3 (at my vacation home) tonight.

Wonder if it is a Gmail issue or a Pmail issue with the time change.

Interesting thought. I think the frequency it has occurred for me is as often as the time has changed. How did you identify that it last occurred at the November time change?

Posted it in here last year on Nov 5th. Since I have to revalidate 18 times, it really sticks out in my memory when I have to make changes.

You may be onto something. I found a related post by me on Nov 5th as well. I haven't found any posts that correspond to the March 10th time change though. I am going to do more searching here and then search the PM-Win support list archives for any other invalid credential reports that correspond with a time change.

You may be onto something. I found a related post by me on Nov 5th as well.

Yup - no issue in March when we moved the clocks forward, but two years in a row when we moved them back. Guess we will find out next November for sure.

Brian Fluet - 2025 Fall time change this morning (2 AM EST) and had to revalidate gmail accounts on all computers just now.

Thanks for posting this Bob. I had forgotten about it. I had to revalidate as well and had forgotten about the fall time change as a potential cause. I'd say it is now confirmed.

Last email that came in via Pmail was at 1:23 AM Emails received starting after 2 AM (2:43 -7:00 AM) to Gmail until I revalidated at 7 AM. Hopefully this will get resolved before next year! Question - I am on 4.81 - have you upgraded to 4.9? Wondering if that might have a fix for the issue?

I have updated. Obviously it did not fix this issue.

Fall Time Change again and needed to revalidate Gmail on all computers. Had hoped it would be fixed by now since it has occured for several years now.

Thanks for the reminder Bob. I had to revalidate as well. I didn't immediately think of the time change issue when the authentication failure occurred but I then received notification of your post via a non-Gmail account which limited my head-scratching to just a couple of seconds.

It's happening to me too, since I switched to OAUTH2 with Gmail ( for about 2 years now, at the same time). One of my Gmail accounts required often revalidation, so I switched to app password. This one is rarely used, maybe that's the reason. Other two work fine while they do but need to revalidate once a year at the same time.

I don't think so because I have two Gmail accounts, one that is very active and one that is rarely used. Both needed to be revalidated after the time change.

A few years ago my active one needed to be revalidated multiple times during a year. Like you, I switched it to app password authentication. I now authenticate with OAUTH2 but I don't remember when or why I switched it back.

I use the password still on mine.
Perhaps if someone could make a copy of the oauth2 when it stops working, and then do the revalidation, and then compare the files to see how much it changes. Be interesting if it is just a specific set of bytes, or if the whole things is different.

Recall many years ago, on an IBM System 34. IBM said that once a basic program was locked it could never be unlocked. Did a test. Had a test program object in library. copy object to regular disk file. Locked program and copied object to an different file. Compared the files, and only a single bit was different. Wrote a program that could then unlock/lock programs. Just copy object to file, flip bit, and copy it back. Don't know the oauth2 process. What inputs it uses and what it does.

The validation process obtains a token from Google. That token is stored in an .OA2 file located in an \OAUTH2 subdirectory of the mailbox directory. The .OA2 file contains 2184 characters of encoded content. Revalidation replaces the existing .OA2 file with a new one (new filename and content).

The associated POP3 host definition file (.PND) is different from others in that:

• it contains a "Flags1 : 524545" entry instead of "Flags1 : 1".
• it does not contain a "Password :" entry.

An unknown to me is what associates the .OA2 file with its .PND file. On revalidation, the .OA2 file gets replaced yet the associated .PND file is not modified. I only have one Gmail account but AFAIK, multiple Gmail accounts via OAUTH2 is possible. Perhaps someone with multiple can share some insight into the .OA2/.PND connection.

" Perhaps someone with multiple can share some insight into the .OA2/.PND connection."

Brian - I have 3 Gmail accounts that are configued in Pegasus with OAUTH2 on multiple computers. All needed to be revalidated as of the Fall time change.

In the OAUTH2 subdirectory I see three OA2 files that were created when I revalidated the 3 Gmail email addresses.

In the Mail directory I see 60 .PND files dating back to 2019 for the many email addresses I have had over the years. None were modified since 2025. Seems to be multiple ones that for each email address I have used. Some but not all point to a .PM3 file.

To see the currently active ones.

type PMAIL.INI | find "PND"
POP3 Definition = POPXVWB5.PND, 0
SMTP Definition = SMT201GA.PND, 0
POP3 Definition = POPASHSK.PND, 0
SMTP Definition = SMTC2XE3.PND, 0
POP3 Definition = POP0HXBP.PND, 0
SMTP Definition = SMT0C353.PND, 0

I believe the PMAIL.INI only has the current ones, but would copy them all first.

I have 3 sets. ISP, GMAIL, and GMX.

@msetzerii Thanks - see the three PND files that are current for the three email address that I am using. Each points to a unique PM3 file.

Does not seem to be any correlation between those and the OA2 files that I can see.

Thanks @bob.h for looking at that. It reassures me that I didn't miss anything.

FWIW, during the early testing of Gmail OAUTH2 there was occasionally a need to manually delete an .OA2 file. It was noted then that when doing this, there was no way to identify the associated .PND and in turn its .PM3. It appears that is still the case.

It sounds like you do what I do in that when I need to change a host definition I will disable the existing one, then create a new one and set it as active. I never get around to deleting the disabled ones which leaves a bunch of unused .PND files and associated .PM3 files. I also have a .PND whose .PM3 file does not exist. I don't know why. That email account is old and dead so this is not a concern, just a curiosity.