diff --git a/xpra/client/auth/env.py b/xpra/client/auth/env.py
index 3a3073e50b..79231e48c2 100644
--- a/xpra/client/auth/env.py
+++ b/xpra/client/auth/env.py
@@ -18,5 +18,5 @@ def __repr__(self):
     def get_digest(self) -> str:
         return ""
 
-    def handle(self, challenge: str, digest: str, prompt: str) -> str:  # pylint: disable=unused-argument
+    def handle(self, challenge: bytes, digest: str, prompt: str) -> str:  # pylint: disable=unused-argument
         return os.environ.get(self.var_name, "")
diff --git a/xpra/client/auth/file.py b/xpra/client/auth/file.py
index 104bd8d591..7af66679a5 100644
--- a/xpra/client/auth/file.py
+++ b/xpra/client/auth/file.py
@@ -26,7 +26,7 @@ def __repr__(self):
     def get_digest(self) -> str:
         return ""
 
-    def handle(self, challenge: str, digest: str, prompt: str) -> bytes:  # pylint: disable=unused-argument
+    def handle(self, challenge: bytes, digest: str, prompt: str) -> bytes:  # pylint: disable=unused-argument
         log("handle(..) password_file=%s", self.password_file)
         if not self.password_file:
             return b""
diff --git a/xpra/client/auth/gss.py b/xpra/client/auth/gss.py
index 7c4438709f..4bab16dc87 100644
--- a/xpra/client/auth/gss.py
+++ b/xpra/client/auth/gss.py
@@ -25,7 +25,7 @@ def __repr__(self):
     def get_digest() -> str:
         return "gss"
 
-    def handle(self, challenge: str, digest, prompt: str):  # pylint: disable=unused-argument
+    def handle(self, challenge: bytes, digest: str, prompt: str):  # pylint: disable=unused-argument
         if not digest.startswith("gss:"):
             # not a gss challenge
             log("%s is not a gss challenge", digest)
diff --git a/xpra/client/auth/kerberos.py b/xpra/client/auth/kerberos.py
index 68b39f487c..62a10876d2 100644
--- a/xpra/client/auth/kerberos.py
+++ b/xpra/client/auth/kerberos.py
@@ -39,7 +39,7 @@ def __repr__(self):
     def get_digest(self) -> str:
         return "kerberos"
 
-    def handle(self, challenge: str, digest: str, prompt: str):  # pylint: disable=unused-argument
+    def handle(self, challenge: bytes, digest: str, prompt: str):  # pylint: disable=unused-argument
         if not digest.startswith("kerberos:"):
             log("%s is not a kerberos challenge", digest)
             # not a kerberos challenge
diff --git a/xpra/client/auth/prompt.py b/xpra/client/auth/prompt.py
index 3671271bdd..95c5349d55 100644
--- a/xpra/client/auth/prompt.py
+++ b/xpra/client/auth/prompt.py
@@ -15,7 +15,7 @@ def __repr__(self):
     def get_digest(self) -> str:
         return ""
 
-    def handle(self, challenge: str, digest: str, prompt: str = "password"):  # pylint: disable=unused-argument
+    def handle(self, challenge: bytes, digest: str, prompt: str = "password"):  # pylint: disable=unused-argument
         digest_type = digest.split(":", 1)[0]
         if not prompt and digest_type in ("gss", "kerberos"):
             prompt = f"{digest_type} token"
diff --git a/xpra/client/auth/u2f.py b/xpra/client/auth/u2f.py
index e6f586db38..441c36c17b 100644
--- a/xpra/client/auth/u2f.py
+++ b/xpra/client/auth/u2f.py
@@ -28,7 +28,7 @@ def __repr__(self):
     def get_digest() -> str:
         return "u2f"
 
-    def handle(self, challenge: str, digest: str, prompt: str) -> (
+    def handle(self, challenge: bytes, digest: str, prompt: str) -> (
             tuple[bytes, bytes] | None):  # pylint: disable=unused-argument
         if not digest.startswith("u2f:"):
             log("%s is not a u2f challenge", digest)
diff --git a/xpra/client/auth/uri.py b/xpra/client/auth/uri.py
index 911f8f6106..24619cf661 100644
--- a/xpra/client/auth/uri.py
+++ b/xpra/client/auth/uri.py
@@ -16,5 +16,5 @@ def __repr__(self):
     def get_digest() -> str:
         return ""
 
-    def handle(self, challenge: str, digest: str, prompt: str) -> str:  # pylint: disable=unused-argument
+    def handle(self, challenge: bytes, digest: str, prompt: str) -> str:  # pylint: disable=unused-argument
         return self.client.password
diff --git a/xpra/client/base/client.py b/xpra/client/base/client.py
index 2f417e3d31..a0a27e1d55 100644
--- a/xpra/client/base/client.py
+++ b/xpra/client/base/client.py
@@ -832,7 +832,7 @@ def do_process_challenge(self, packet: PacketType) -> None:
         while self.challenge_handlers:
             handler = self.pop_challenge_handler(digest)
             try:
-                challenge = packet[1]
+                challenge = strtobytes(packet[1])
                 prompt = "password"
                 if len(packet) >= 6:
                     prompt = std(str(packet[5]), extras="-,./: '")