diff --git a/Test-Login.ps1 b/Test-Login.ps1
index b371845..9e63689 100644
--- a/Test-Login.ps1
+++ b/Test-Login.ps1
@@ -114,6 +114,24 @@ $bstr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure)
 $password = [Runtime.InteropServices.Marshal]::PtrToStringAuto($bstr)
 [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($bstr)
 
+# Nothing echoes while typing, so a slipped paste looks identical to a good
+# one. Typing it twice is the only way to be sure of what actually went in.
+Write-Host "Type it once more to check: " -NoNewline -ForegroundColor White
+$secure2 = Read-Host -AsSecureString
+$bstr2 = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure2)
+$password2 = [Runtime.InteropServices.Marshal]::PtrToStringAuto($bstr2)
+[Runtime.InteropServices.Marshal]::ZeroFreeBSTR($bstr2)
+
+if ($password -ne $password2) {
+    Write-Host ""
+    Write-Host "  !! The two did not match." -ForegroundColor Red
+    Write-Host "     First entry: $($password.Length) characters. Second: $($password2.Length)." -ForegroundColor Red
+    Write-Host "     One of them is wrong, so this test would prove nothing." -ForegroundColor Red
+    Write-Host "     Start over and paste carefully, or type it by hand." -ForegroundColor Yellow
+    Write-Host ""
+    exit 1
+}
+
 # -- What the credentials actually contain ------------------------------------
 Write-Host ""
 Write-Host ("-" * 64)
@@ -230,18 +248,47 @@ if (-not $connected -and (Test-Path $logFile)) {
     Write-Host ("-" * 64)
     Write-Host "What the server actually said" -ForegroundColor Cyan
     Write-Host ("-" * 64)
-    $interesting = Select-String -Path $logFile -Pattern "authentic|password|keyboard|publickey|banner|denied|method" -AllMatches
-    if ($interesting) {
-        foreach ($line in ($interesting | Select-Object -First 30)) {
-            Write-Host "  $($line.Line.Trim())" -ForegroundColor Gray
-        }
-        Write-Host ""
-        Write-Host "  Look for the line listing which methods the server offers." -ForegroundColor Yellow
-        Write-Host "  If it offers only 'publickey', a password will never work and" -ForegroundColor Yellow
-        Write-Host "  the partner has to either enable password auth or issue a key." -ForegroundColor Yellow
-    } else {
-        Write-Host "  (nothing recognisable - see the full log)" -ForegroundColor Gray
+
+    $log = Get-Content $logFile -ErrorAction SilentlyContinue
+
+    $server = $log | Select-String -Pattern "Remote version:" | Select-Object -First 1
+    if ($server) { Write-Host "  $(($server.Line -split 'Remote version:')[1].Trim())" -ForegroundColor Gray }
+
+    $methodLine = $log | Select-String -Pattern "Server offered these authentication methods:" | Select-Object -First 1
+    $methods = ""
+    if ($methodLine) {
+        $methods = (($methodLine.Line -split "authentication methods:")[1]).Trim()
+        Write-Host "  Methods the server accepts: $methods" -ForegroundColor Gray
     }
+
+    $sentPassword = ($log | Select-String -Pattern "Sent password").Count -gt 0
+    $pwRejected   = ($log | Select-String -Pattern "Password authentication failed").Count -gt 0
+
+    Write-Host ""
+    if ($pwRejected -or ($sentPassword -and -not $connected)) {
+        Write-Host "  The password reached the server and the server rejected it." -ForegroundColor Yellow
+        Write-Host ""
+        Write-Host "  That rules out the script, the protocol, the port and the host" -ForegroundColor Yellow
+        Write-Host "  key - all of those worked. Only three things are left:" -ForegroundColor Yellow
+        Write-Host ""
+        Write-Host "    1. The password is not the one this account expects." -ForegroundColor White
+        Write-Host "       Check it is this practice's own password, not another's." -ForegroundColor Gray
+        Write-Host "    2. The account is locked out from repeated failed tries," -ForegroundColor White
+        Write-Host "       or expired. Log in with the WinSCP window right now - if" -ForegroundColor Gray
+        Write-Host "       that fails too, it is the account, not anything here." -ForegroundColor Gray
+        Write-Host "    3. The account is set to require a key rather than a" -ForegroundColor White
+        Write-Host "       password, even though the server allows passwords" -ForegroundColor Gray
+        Write-Host "       generally. Only the partner can tell you that." -ForegroundColor Gray
+    } elseif ($methods -and $methods -notmatch "password") {
+        Write-Host "  The server never offered password authentication." -ForegroundColor Yellow
+        Write-Host "  It accepts: $methods" -ForegroundColor Yellow
+        Write-Host "  A password will never work here - the partner has to enable" -ForegroundColor Yellow
+        Write-Host "  password auth or issue an SSH key for this account." -ForegroundColor Yellow
+    } else {
+        Write-Host "  It failed before any password was sent - so this is about" -ForegroundColor Yellow
+        Write-Host "  reaching the server, not about the credentials." -ForegroundColor Yellow
+    }
+
     Write-Host ""
     Write-Host "  Full log: $logFile" -ForegroundColor Cyan
     Write-Host "  It contains no password. Send it to Brad." -ForegroundColor Cyan