diff --git a/CHANGELOG.md b/CHANGELOG.md
index d809f5e..d2a21dc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -45,6 +45,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **CRITICAL**: SSL fingerprint prompt no longer causes authentication timeout
   - Script now automatically accepts SSL fingerprints by piping 'y' to login
   - This was the root cause of "authentication hanging" issues
+- **CRITICAL**: Password/token capture no longer includes newline character
+  - `prompt_password()` function now outputs formatting to stderr
+  - Fixes "authentication failed - invalid credentials" in backup service
+  - Config file now has properly formatted single-line passwords
 - Script no longer hangs indefinitely when PBS server is unreachable
 - Block device auto-detection now correctly handles btrfs subvolumes
 - Invalid device paths like `/dev/mapper/root[/@]` are now properly cleaned
diff --git a/pbs-client-installer.sh b/pbs-client-installer.sh
index 64d3492..b047886 100755
--- a/pbs-client-installer.sh
+++ b/pbs-client-installer.sh
@@ -51,7 +51,7 @@ prompt_password() {
     local prompt_text="$1"
     local user_input
     read -sp "$(echo -e ${BLUE}${prompt_text}${NC}: )" user_input
-    echo
+    echo >&2  # Output newline to stderr so it doesn't get captured
     echo "$user_input"
 }