## TL;DR
That flat zero usually means hydra never really talked to the service: wrong module syntax, wrong port, or a failure string it misread. Verify the login manually first, then fix the module invocation, then re-run verbose so you can see what the server actually said on each attempt.

```text
0 of 1 target successfully completed, 0 valid passwords found
```

## Use this when
- Hydra completes cleanly against an authorized lab target but reports nothing, and you know at least one test credential should hit.
- You are unsure whether the problem is the target, the wordlists, or the command line.

## Not for this skill when
- Hydra crashes or hangs. That is a different failure with its own fix.
- You are testing credentials you do not own against systems outside your scope. This skill is lab and authorized-engagement only.

## Steps
1. Prove the service and a known-good credential manually first, with the real client or the login form in a browser. Verify: you have a confirmed working login before blaming hydra.
2. Run hydra verbose against that one known credential: `hydra -l knownuser -p knownpass -V ssh://target/`. Verify: `-V` shows per-attempt lines so you can see what the server returns.
3. For web form modules, confirm the failure string matches what the app actually returns on a bad login. Verify: the failure string you gave hydra appears verbatim in a manual bad-login response.
4. Drop parallelism to isolate the issue: `-t 1 -w 30`. Verify: the result is the same single-threaded, which rules out a race or a lockout.
5. Check the service banner and port: the ssh module pointed at a non-ssh port fails silently into zero results. Verify: the banner matches the module you chose.

## Variant phrasings
### hydra found no valid passwords but password is correct
The false-negative phrasing.
### hydra 0 valid passwords http-post-form
Module-specific version of the same problem.

Compatibility: thc-hydra 9.x. The `service://host/options` module syntax is stable across recent versions.

## Why it happens
Hydra decides success by matching server responses against expected patterns. A wrong module, a subtly wrong failure string, or a service that silently rate-limits all produce the same flat zero: hydra technically completed, it just never recognized a hit.

## Edge cases / pitfalls
- Lab apps that return HTTP 200 for both good and bad logins need the failure string to be exact. One wrong word and every attempt reads as failed.
- Account lockout policies on the lab target can turn an early attempt into a lockout that poisons the rest of the run. Check the lockout policy before a big wordlist.
- Never point hydra at credentials or systems outside the engagement scope. A zero-result run against the wrong target is still an unauthorized login attempt.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_b-h_rj-jo63gdGIsAIYk_w